CVE-2011-0418: Input Validation
Multiple libc/glob(3) flaws were reported [1] that affect various BSD libc implementations. In particular, globs containing braces could lead to resource exhaustion.
One such vulnerable application is Pure-FTPd. This has been corrected in upstream version 1.0.32, where support for braces expansion in directory listings was disabled.
[1] http://securityreason.com/achievementsecurityalert/97 [2] http://www.pureftpd.org/project/pure-ftpd/news
Other sources
The glob implementation in Pure-FTPd before 1.0.32, and in libc in NetBSD 5.1, does not properly expand expressions containing curly brackets, which allows remote authenticated users to cause a denial of service (memory consumption) via a crafted FTP STAT command.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2011-0418?
The severity of CVE-2011-0418 is rated as moderate due to its potential for resource exhaustion.
How do I fix CVE-2011-0418?
To fix CVE-2011-0418, update Pure-FTPd to version 1.0.32 or later.
Which versions of Pure-FTPd are affected by CVE-2011-0418?
CVE-2011-0418 affects Pure-FTPd versions 0.97-final, 0.98-final, 1.0.19, and several earlier versions.
What types of attacks are possible due to CVE-2011-0418?
CVE-2011-0418 can be exploited for denial-of-service attacks by triggering resource exhaustion.
Is there a known exploit for CVE-2011-0418?
As of now, there are no publicly available exploits specifically targeting CVE-2011-0418.