CVE-2011-0762 in vsftpd
Summary
by MITRE
The vsf_filename_passes_filter function in ls.c in vsftpd before 2.3.3 allows remote authenticated users to cause a denial of service (CPU consumption and process slot exhaustion) via crafted glob expressions in STAT commands in multiple FTP sessions, a different vulnerability than CVE-2010-2632.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 01/18/2025
The vulnerability identified as CVE-2011-0762 affects the vsftpd FTP server version 2.3.2 and earlier, specifically targeting the vsf_filename_passes_filter function within the ls.c source file. This flaw represents a denial of service condition that can be exploited by authenticated remote attackers who manipulate glob expressions in STAT commands across multiple FTP sessions. The vulnerability operates through a path traversal mechanism that causes excessive CPU consumption and eventual process slot exhaustion, effectively rendering the FTP service unavailable to legitimate users.
The technical implementation of this vulnerability stems from inadequate input validation and filtering mechanisms within the vsftpd codebase. When a remote authenticated user submits crafted glob expressions through STAT commands, the vsf_filename_passes_filter function processes these patterns without sufficient sanitization or resource limiting. This processing causes the system to enter into computationally expensive operations that consume significant CPU cycles and exhaust available process slots. The vulnerability specifically affects the file listing functionality where glob patterns are evaluated, creating a resource exhaustion scenario that can be amplified across multiple concurrent FTP sessions. The flaw is categorized under CWE-400 as an Uncontrolled Resource Consumption vulnerability, which directly maps to the denial of service characteristics observed in this exploit.
Operational impact of CVE-2011-0762 extends beyond simple service disruption to encompass broader system availability concerns. The vulnerability can be leveraged to create sustained denial of service conditions that may persist until the affected FTP server is manually restarted or the system is rebooted. Attackers can maintain multiple concurrent FTP sessions to maximize the resource consumption impact, making this attack particularly effective in environments where FTP services are heavily utilized. The vulnerability also aligns with ATT&CK technique T1499.004, which describes Network Denial of Service attacks that target availability through resource exhaustion. This attack vector can be particularly damaging in mission-critical environments where FTP services are essential for business operations, as it can lead to complete service unavailability and potential financial losses.
Mitigation strategies for CVE-2011-0762 require immediate patching of the vsftpd server to version 2.3.3 or later, which contains the necessary code fixes to properly validate and sanitize glob expressions in STAT commands. Organizations should implement rate limiting mechanisms to restrict the number of concurrent FTP sessions that can be established, thereby reducing the effectiveness of resource exhaustion attacks. Network-level controls including firewall rules that limit FTP traffic and monitoring systems that detect unusual CPU consumption patterns can provide additional layers of defense. System administrators should also consider implementing process monitoring to detect when FTP processes begin consuming excessive CPU resources, enabling rapid response to potential exploitation attempts. The vulnerability demonstrates the importance of proper input validation and resource management in network services, particularly those handling user-provided patterns and expressions. Regular security assessments and vulnerability scanning should be conducted to identify similar weaknesses in other network services and prevent similar issues from arising in the future.