CVE-2011-0762
NUCLEIvsftpd < 2.3.3 - Authenticated Denial of Service via Glob Expression in STAT Command
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2011-0762.
PoCs published by Maksymilian Arciemowicz, s3mPr1linux, including Metasploit module auxiliary/dos/ftp/vsftpd_232.
A Nuclei detection template is also available.
AI-analyzed exploit summary This exploit triggers a remote denial of service (DoS) in vsftpd 2.3.2 by sending a malformed STAT command with deeply nested braces, causing the service to crash with a 'fork' error.
Description
The vsf_filename_passes_filter function in ls.c in vsftpd before 2.3.3 allows remote authenticated users to cause a denial of service (CPU consumption and process slot exhaustion) via crafted glob expressions in STAT commands in multiple FTP sessions, a different vulnerability than CVE-2010-2632.
Exploits (3)
This exploit triggers a remote denial of service (DoS) in vsftpd 2.3.2 by sending a malformed STAT command with deeply nested braces, causing the service to crash with a 'fork' error.
This repository contains a functional exploit in C for CVE-2011-0762, targeting a vulnerability in FTP servers via a maliciously crafted STAT command with nested braces. The exploit establishes a connection, authenticates, and sends the payload to trigger potential memory corruption or crashes.
This Metasploit module exploits a Denial of Service (DoS) vulnerability in VSFTPD versions before 2.3.3 by sending a malformed STAT command with a large number of nested braces, causing the service to crash.
Nuclei Templates (1)
vsftpd || product:"vsftpd"