The glob implementation in Pure-FTPd before 1.0.32, and in libc in NetBSD 5.1, does not properly expand expressions containing curly brackets, which allows remote authenticated users to cause a denial of service (memory consumption) via a crafted FTP STAT command.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The glob implementation in Pure-FTPd before 1.0.32, and in libc in NetBSD 5.1, does not properly expand
    expressions containing curly brackets, which allows remote authenticated users to cause a denial of
    service (memory consumption) via a crafted FTP STAT command. (CVE-2011-0418)

The remote host is affected by the vulnerability described in GLSA-201110-25 (Pure-FTPd: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Pure-FTPd. Please       review the CVE identifiers referenced below for details.
  Impact :

    Remote unauthenticated attackers may be able to inject FTP commands or       cause a Denial of Service.
  Workaround :

    There is no known workaround at this time.

Updating to current 1.0.32 version.

  - added support SHA1 password hashing in MySQL and     PostgreSQL backends

    - removed support for braces expansion in directory       listings has been disabled CVE-2011-0418

    - list of allowed ciphers for SSL/TLS connections can be       specified

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Pure-FTPd development team reports :

Support for braces expansion in directory listings has been disabled
-- Cf. CVE-2011-0418.

Fix a STARTTLS flaw similar to Postfix's CVE-2011-0411. If you're using TLS, upgrading is recommended.

A denial-of-service (DoS) attack related to glob brace expansion was discovered and fixed in pure-ftpd (CVE-2011-0418).

Packages for 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149 products_id=490

The updated packages have been upgraded to the latest 1.0.32 version which is not vulnerable to this issue.

ID	Name	Product	Family	Severity
401343	Alpine: multiple pure-ftpd packages: security update to 1.0.30-r2 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	high
401343	Alpine: multiple pure-ftpd packages: security update to 1.0.30-r2 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
56659	GLSA-201110-25 : Pure-FTPd: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
55387	Fedora 14 : pure-ftpd-1.0.32-1.fc14 (2011-7374)	Nessus	Fedora Local Security Checks	medium
54916	Fedora 15 : pure-ftpd-1.0.32-1.fc15 (2011-7434)	Nessus	Fedora Local Security Checks	medium
54620	FreeBSD : pureftpd -- multiple vulnerabilities (1495f931-8522-11e0-a1c1-00215c6a37bb)	Nessus	FreeBSD Local Security Checks	medium
54589	Mandriva Linux Security Advisory : pure-ftpd (MDVSA-2011:094)	Nessus	Mandriva Local Security Checks	medium

Detections

Analytics

CVE-2011-0418

medium

Tenable Plugins

high

high

medium

medium

medium

medium

medium