CVE-2010-4755 in OpenSSH
Summary
by MITRE
The (1) remote_glob function in sftp-glob.c and the (2) process_put function in sftp.c in OpenSSH 5.8 and earlier, as used in FreeBSD 7.3 and 8.1, NetBSD 5.0.2, OpenBSD 4.7, and other products, allow remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in SSH_FXP_STAT requests to an sftp daemon, a different vulnerability than CVE-2010-2632.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/18/2021
The vulnerability identified as CVE-2010-4755 represents a significant denial of service weakness in OpenSSH implementations that affects multiple operating systems including FreeBSD, NetBSD, and OpenBSD. This flaw exists within the Secure Shell File Transfer Protocol implementation where specifically crafted glob expressions can trigger excessive resource consumption. The vulnerability manifests in two distinct functions: remote_glob in sftp-glob.c and process_put in sftp.c, both of which handle file operations within the SFTP subsystem. When authenticated remote users submit glob patterns that do not match any existing file paths, the affected implementations enter into resource-intensive processing loops that consume substantial CPU cycles and memory resources.
The technical root cause of this vulnerability stems from inadequate input validation and handling of glob pattern matching operations within the SFTP daemon. When a glob expression fails to match any files, the processing functions continue to iterate through complex pattern matching algorithms without proper termination conditions or resource limits. This behavior creates a condition where malicious users can craft specific glob patterns that cause the SFTP server to consume escalating amounts of computational resources. The vulnerability specifically affects SSH_FXP_STAT requests where glob expressions are processed, making it particularly dangerous as it can be exploited through standard SFTP operations that are commonly used by legitimate users. The flaw demonstrates characteristics consistent with CWE-400, which addresses unchecked resource consumption, and represents a classic example of how improper handling of user input can lead to denial of service conditions.
The operational impact of CVE-2010-4755 extends beyond simple service disruption to potentially compromising system availability and stability. Attackers can repeatedly submit malformed glob expressions to consume system resources until the SFTP daemon becomes unresponsive or the system reaches resource exhaustion. This vulnerability affects the availability aspect of the CIA triad by making the SFTP service unreliable for legitimate users. The attack vector requires only authenticated access, which means that any user with valid credentials can potentially exploit this weakness. The resource consumption patterns observed in exploitation typically show exponential growth in CPU utilization and memory allocation, making detection and mitigation challenging. Systems running affected OpenSSH versions become increasingly vulnerable to this attack as the number of concurrent sessions increases, since each session can independently consume resources.
Mitigation strategies for CVE-2010-4755 focus on both immediate patching and operational controls. The most effective solution involves updating to OpenSSH versions that contain the specific fixes for these glob processing functions, typically OpenSSH 5.9 or later. System administrators should also implement resource monitoring and limiting mechanisms to detect unusual CPU and memory consumption patterns. Network-level controls such as connection rate limiting and resource quotas can help prevent exploitation by limiting the number of concurrent SFTP operations. Additionally, implementing proper input sanitization and validation within SFTP applications can help prevent malformed glob patterns from reaching the vulnerable processing functions. The ATT&CK framework categorizes this vulnerability under privilege escalation and denial of service tactics, with the specific technique being resource exhaustion through malformed input processing. Organizations should also consider implementing automated monitoring solutions that can detect abnormal resource consumption patterns and alert administrators to potential exploitation attempts. Regular vulnerability assessments and penetration testing should include verification of SFTP glob handling capabilities to ensure proper protection against this class of attack.