CVE-2001-0247

NetBSD - Remote Code Execution via Long Pattern String with {} Sequence

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 3 public exploits for CVE-2001-0247. PoCs published by Elias Levy, fish stiqz.

AI-analyzed exploit summary This exploit targets a buffer overflow vulnerability in BSD-based FTP daemons (e.g., OpenBSD 2.x-2.8) by leveraging directory name expansion via glob() to overflow a buffer and execute arbitrary shellcode, resulting in root access. The exploit constructs a malicious LIST command with a crafted path to trigger the overflow and includes shellcode to spawn a root shell.

Description

Buffer overflows in BSD-based FTP servers allows remote attackers to execute arbitrary commands via a long pattern string containing a {} sequence, as seen in (1) g_opendir, (2) g_lstat, (3) g_stat, and (4) the glob0 buffer as used in the glob functions glob2 and glob3.

Exploits (3)

exploitdb WORKING POC VERIFIED
by Elias Levy · cremoteopenbsd
https://www.exploit-db.com/exploits/20733

This exploit targets a buffer overflow vulnerability in BSD-based FTP daemons (e.g., OpenBSD 2.x-2.8) by leveraging directory name expansion via glob() to overflow a buffer and execute arbitrary shellcode, resulting in root access. The exploit constructs a malicious LIST command with a crafted path to trigger the overflow and includes shellcode to spawn a root shell.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: BSD ftpd (including OpenBSD 2.x-2.8, IRIX ftpd, Kerberos 5 ftpd)
Auth required
Prerequisites: FTP access (anonymous or authenticated) · Presence of a directory with a long name (>=16 chars) or ability to create one
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC VERIFIED
by Elias Levy · perlremotefreebsd
https://www.exploit-db.com/exploits/20732

This exploit targets a buffer overflow vulnerability in BSD-based FTP daemons (CVE-2001-0247) by leveraging glob() expansion to overflow memory during directory listing operations. It sends a crafted STAT command with shellcode to achieve remote code execution as root.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: BSD ftpd and derivatives (e.g., FreeBSD 4.2-stable, IRIX ftpd, Kerberos 5 ftpd)
Auth required
Prerequisites: Valid FTP credentials · Writeable home directory without chroot restrictions
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC VERIFIED
by fish stiqz · cremotebsd
https://www.exploit-db.com/exploits/20731

This exploit targets a buffer overflow vulnerability in BSD-based FTP daemons (e.g., FreeBSD 4.X, OpenBSD 2.8) by leveraging glob() expansion to overflow buffers during path parsing. It includes shellcode for setuid(0) and execve() to achieve remote root access.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: BSD FTP Daemon (e.g., FreeBSD 4.X, OpenBSD 2.8)
Auth required
Prerequisites: Valid FTP account with directory creation privileges · Target running vulnerable BSD-based FTP daemon
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (7)

Core 7
Core References
Patch, Vendor Advisory vendor-advisory x_refsource_freebsd
http://archives.neohapsis.com/archives/freebsd/2001-04/0466.html
Exploit, Patch, Vendor Advisory vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/2548
Various Sources vendor-advisory x_refsource_nai
http://www.nai.com/research/covert/advisories/048.asp
Patch, Third Party Advisory, US Government Resource third-party-advisory x_refsource_cert
http://www.cert.org/advisories/CA-2001-07.html
Vendor Advisory vendor-advisory x_refsource_sgi
ftp://patches.sgi.com/support/free/security/advisories/20010802-01-P
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/6332

Scores

EPSS 0.1932
EPSS Percentile 97.0%

Details

Status published
Products (50)
freebsd/freebsd 2.2
freebsd/freebsd 2.2.2
freebsd/freebsd 2.2.3
freebsd/freebsd 2.2.4
freebsd/freebsd 2.2.5
freebsd/freebsd 2.2.6
freebsd/freebsd 2.2.8
freebsd/freebsd 3.0
freebsd/freebsd 3.1
freebsd/freebsd 3.2
... and 40 more
Published Jun 18, 2001
Tracked Since Feb 18, 2026