CVE-2011-0762

Name: CVE-2011-0762
Creator: NVD / NIST
Published: 2011-03-02T20:00:01.77+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 73.32%

Last modified Jun 16, 2026

CVE-2011-0762 is a vulnerability of currently unknown severity. The vsf_filename_passes_filter function in ls.c in vsftpd before 2.3.3 allows remote authenticated users to cause a denial of service (CPU consumption and process slot exhaustion) via crafted glob expressions in STAT commands in multiple FTP sessions, a different vulnerability than CVE-2010-2632.. EPSS estimates a 73.32% chance of exploitation in the next 30 days.

Description

The vsf_filename_passes_filter function in ls.c in vsftpd before 2.3.3 allows remote authenticated users to cause a denial of service (CPU consumption and process slot exhaustion) via crafted glob expressions in STAT commands in multiple FTP sessions, a different vulnerability than CVE-2010-2632.

Metrics

EPSS Probability

73.32%

99.4th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-400

Affected Software

Vendor	Product	Versions	Update
Vsftpd Project	Vsftpd	< 2.3.3	—
Canonical	Ubuntu Linux	6.06	—
Canonical	Ubuntu Linux	8.04	—
Canonical	Ubuntu Linux	9.10	—
Canonical	Ubuntu Linux	10.04	—
Canonical	Ubuntu Linux	10.10	—
Fedoraproject	Fedora	13	—
Fedoraproject	Fedora	14	—
Fedoraproject	Fedora	15	—
Debian	Debian Linux	5.0	—
Debian	Debian Linux	6.0	—
Debian	Debian Linux	7.0	—
Opensuse	Opensuse	11.2	—
Opensuse	Opensuse	11.3	—
Opensuse	Opensuse	11.4	—
Suse	Linux Enterprise Server	9	—
Suse	Linux Enterprise Server	10	Sp3
Suse	Linux Enterprise Server	11	Sp1

References

ftp://vsftpd.beasts.org/users/cevans/untar/vsftpd-2.3.4/ChangelogBroken Link
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=622741Issue Tracking, Third Party Advisory
http://cxib.net/stuff/vspoc232.cBroken Link
http://jvn.jp/en/jp/JVN37417423/index.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055881.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055882.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055957.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.htmlMailing List, Third Party Advisory
http://marc.info/?l=bugtraq&m=133226187115472&w=2Issue Tracking, Third Party Advisory
http://securityreason.com/achievement_securityalert/95Exploit, Third Party Advisory
http://securityreason.com/securityalert/8109Exploit, Third Party Advisory
http://www.debian.org/security/2011/dsa-2305Third Party Advisory
http://www.exploit-db.com/exploits/16270Exploit, Third Party Advisory, VDB Entry
http://www.kb.cert.org/vuls/id/590604Broken Link
http://www.mandriva.com/security/advisories?name=MDVSA-2011:049Third Party Advisory
http://www.redhat.com/support/errata/RHSA-2011-0337.htmlThird Party Advisory
http://www.securityfocus.com/archive/1/516748/100/0/threadedThird Party Advisory, VDB Entry
http://www.securityfocus.com/bid/46617Exploit, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id?1025186Third Party Advisory, VDB Entry
http://www.ubuntu.com/usn/USN-1098-1Third Party Advisory
http://www.vupen.com/english/advisories/2011/0547Third Party Advisory
http://www.vupen.com/english/advisories/2011/0639Third Party Advisory
http://www.vupen.com/english/advisories/2011/0668Third Party Advisory
http://www.vupen.com/english/advisories/2011/0713Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/65873Third Party Advisory, VDB Entry
ftp://vsftpd.beasts.org/users/cevans/untar/vsftpd-2.3.4/ChangelogBroken Link
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=622741Issue Tracking, Third Party Advisory
http://cxib.net/stuff/vspoc232.cBroken Link
http://jvn.jp/en/jp/JVN37417423/index.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055881.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055882.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055957.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.htmlMailing List, Third Party Advisory
http://marc.info/?l=bugtraq&m=133226187115472&w=2Issue Tracking, Third Party Advisory
http://securityreason.com/achievement_securityalert/95Exploit, Third Party Advisory
http://securityreason.com/securityalert/8109Exploit, Third Party Advisory
http://www.debian.org/security/2011/dsa-2305Third Party Advisory
http://www.exploit-db.com/exploits/16270Exploit, Third Party Advisory, VDB Entry
http://www.kb.cert.org/vuls/id/590604Broken Link
http://www.mandriva.com/security/advisories?name=MDVSA-2011:049Third Party Advisory
http://www.redhat.com/support/errata/RHSA-2011-0337.htmlThird Party Advisory
http://www.securityfocus.com/archive/1/516748/100/0/threadedThird Party Advisory, VDB Entry
http://www.securityfocus.com/bid/46617Exploit, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id?1025186Third Party Advisory, VDB Entry
http://www.ubuntu.com/usn/USN-1098-1Third Party Advisory
http://www.vupen.com/english/advisories/2011/0547Third Party Advisory
http://www.vupen.com/english/advisories/2011/0639Third Party Advisory
http://www.vupen.com/english/advisories/2011/0668Third Party Advisory
http://www.vupen.com/english/advisories/2011/0713Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/65873Third Party Advisory, VDB Entry

Timeline

Published: Mar 2, 2011
Last Modified: Jun 16, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2011-0762?

How severe is CVE-2011-0762?

Severity scoring for CVE-2011-0762 is pending analysis. The EPSS model estimates a 73.32% probability of exploitation in the next 30 days.

How do I fix CVE-2011-0762?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2011-0762?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST