PT-2004-3154 · Vsftpd · Vsftpd

Olivier Baudron · Publicado 2004-12-31 · Atualizado 2017-10-11 · CVE-2004-2259

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions: vsftpd versions prior to 1.2.2

Description: The issue is related to a denial of service condition that can be triggered under heavy load, causing the ftp server to crash or hang. This is due to an error in connection handling, which can result in a loss of availability for the ftp server. When the server is under heavy load, attackers can exploit this issue by sending a SIGCHLD signal during a malloc or free call, which is not re-entrant, leading to a crash.

Recommendations: For vsftpd versions prior to 1.2.2, update to version 1.2.2 or later to resolve the issue. As a temporary workaround, consider implementing measures to reduce the load on the ftp server and minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2004-2259

Produtos afetados

Vsftpd

Referências · 14

• http://xforce.iss.net/xforce/xfdb/16222 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16222 · Nota
• https://security-tracker.debian.org/tracker/CVE-2004-2259 · Aviso do Fabricante
• http://securityfocus.com/bid/10394 · Nota
• https://osv.dev/vulnerability/CVE-2004-2259 · Aviso do Fabricante
• http://osvdb.org/6306 · Correção
• http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=119136 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2004-2259 · Nota de Segurança
• http://secunia.com/advisories/11680 · Aviso do Fabricante
• ftp://vsftpd.beasts.org/users/cevans/untar/vsftpd-1.2.2/Changelog · Nota
• http://rhn.redhat.com/errata/RHBA-2004-164.html · Correção, Aviso do Fabricante
• http://secunia.com/advisories/11736 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2004-2259 · Aviso do Fabricante
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11049 · Nota