PT-2004-3154 · Vsftpd · Vsftpd

Olivier Baudron · Published 2004-12-31 · Updated 2017-10-11 · CVE-2004-2259

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions: vsftpd versions prior to 1.2.2

Description: The issue is related to a denial of service condition that can be triggered under heavy load, causing the ftp server to crash or hang. This is due to an error in connection handling, which can result in a loss of availability for the ftp server. When the server is under heavy load, attackers can exploit this issue by sending a SIGCHLD signal during a malloc or free call, which is not re-entrant, leading to a crash.

Recommendations: For vsftpd versions prior to 1.2.2, update to version 1.2.2 or later to resolve the issue. As a temporary workaround, consider implementing measures to reduce the load on the ftp server and minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2004-2259

Affected Products

Vsftpd

References · 14

• https://security-tracker.debian.org/tracker/CVE-2004-2259 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2004-2259 · Vendor Advisory
• http://osvdb.org/6306 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2004-2259 · Security Note
• http://secunia.com/advisories/11680 · Vendor Advisory
• http://secunia.com/advisories/11736 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2004-2259 · Vendor Advisory
• http://xforce.iss.net/xforce/xfdb/16222 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16222 · Note
• http://securityfocus.com/bid/10394 · Note
• http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=119136 · Note
• ftp://vsftpd.beasts.org/users/cevans/untar/vsftpd-1.2.2/Changelog · Note
• http://rhn.redhat.com/errata/RHBA-2004-164.html · Patch, Vendor Advisory
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11049 · Note