The wu_fnmatch function in wu_fnmatch.c in wu-ftpd 2.6.1 and 2.6.2 allows remote attackers to cause a denial of service (CPU exhaustion by recursion) via a glob pattern with a large number of * (wildcard) characters, as demonstrated using the dir command.

s700_800 11.11 ftpd(1M) and ftp(1) patch : 

A potential vulnerability has been identified with HP-UX running wu-ftpd where the vulnerability could be exploited by an authorized remote user to create a Denial of Service (DoS).

s700_800 11.00 ftpd(1M) and ftp(1) patch : 

A potential vulnerability has been identified with HP-UX running wu-ftpd where the vulnerability could be exploited by an authorized remote user to create a Denial of Service (DoS).

s700_800 11.23 ftpd(1M) and ftp(1) patch : 

A potential vulnerability has been identified with HP-UX running wu-ftpd where the vulnerability could be exploited by an authorized remote user to create a Denial of Service (DoS).

An iDEFENSE Security Advisory reports :

Remote exploitation of an input validation vulnerability in version 2.6.2 of WU-FPTD could allow for a denial of service of the system by resource exhaustion.

The vulnerability specifically exists in the wu_fnmatch() function in wu_fnmatch.c. When a pattern containing a '*' character is supplied as input, the function calls itself recursively on a smaller substring.
By supplying a string which contains a large number of '*' characters, the system will take a long time to return the results, during which time it will be using a large amount of CPU time.

Several denial of service conditions have been discovered in wu-ftpd, the popular FTP daemon. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CAN-2005-0256     Adam Zabrocki discovered a denial of service condition     in wu-ftpd that could be exploited by a remote user and     cause the server to slow down by resource exhaustion.

  - CAN-2003-0854

    Georgi Guninski discovered that /bin/ls may be called     from within wu-ftpd in a way that will result in large     memory consumption and hence slow down the server.

The remote host is running a WU-FTPD FTP server.  This version of WU-FTPD is vulnerable to a remote Denial of Service (DoS).  Specifically, by sending a LIST request with many '*' characters causes the remote server to crash.  This introduces a risk to availability.

The version of WU-FTPD running on the remote host exhausts all available resources on the server when it repeatedly receives the following command :

LIST *****[...]*.*

This issue has been confirmed in WU-FTPD 2.6.2 and earlier.

ID	Name	Product	Family	Type	Severity
21552	HP-UX PHNE_34544 : HP-UX Running wu-ftpd Remote Denial of Service (DoS) (HPSBUX02110 SSRT061110 rev.1)	Nessus	HP-UX Local Security Checks	Local	medium
21551	HP-UX PHNE_34543 : HP-UX Running wu-ftpd Remote Denial of Service (DoS) (HPSBUX02110 SSRT061110 rev.1)	Nessus	HP-UX Local Security Checks	Local	medium
21550	HP-UX PHNE_34306 : HP-UX Running wu-ftpd Remote Denial of Service (DoS) (HPSBUX02110 SSRT061110 rev.1)	Nessus	HP-UX Local Security Checks	Local	medium
19162	FreeBSD : wu-ftpd -- remote globbing DoS vulnerability (ef410571-a541-11d9-a788-0001020eed82)	Nessus	FreeBSD Local Security Checks	Local	medium
18010	Debian DSA-705-1 : wu-ftpd - missing input sanitising	Nessus	Debian Local Security Checks	Local	medium
2746	WU-FTPD FTP Server File Globbing Remote DoS	Nessus Network Monitor	FTP Servers		high
17602	WU-FTPD wu_fnmatch() Function File Globbing Remote DoS	Nessus	FTP	Remote	high

Detections

Analytics

CVE-2005-0256

high

Tenable Plugins

medium

medium

medium

medium

medium

high

high