net/core/net_namespace.c in the Linux kernel 2.6.32 and earlier does not properly handle a high rate of creation and cleanup of network namespaces, which makes it easier for remote attackers to cause a denial of service (memory consumption) via requests to a daemon that requires a separate namespace per connection, as demonstrated by vsftpd.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - net/core/net_namespace.c in the Linux kernel 2.6.32 and earlier does not properly handle a high rate of     creation and cleanup of network namespaces, which makes it easier for remote attackers to cause a denial     of service (memory consumption) via requests to a daemon that requires a separate namespace per     connection, as demonstrated by vsftpd. (CVE-2011-2189)

Note that Nessus relies on the presence of the package as reported by the vendor.

It was discovered that the 2.6.35 and earlier Linux kernel does not properly handle a high rate of creation and cleanup of network namespaces, which makes it easier for remote attackers to cause a denial of service (memory consumption) in applications that require a separate namespace per connection, like vsftpd. This update adjusts vsftpd to only use network namespaces on kernels that are known to be not affected.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Two security issue have been discovered that affect vsftpd, a lightweight, efficient FTP server written for security.

  - CVE-2011-2189     It was discovered that Linux kernels < 2.6.35 are     considerably slower in releasing than in the creation of     network namespaces. As a result of this and because     vsftpd is using this feature as a security enhancement     to provide network isolation for connections, it is     possible to cause denial of service conditions due to     excessive memory allocations by the kernel. This is     technically no vsftpd flaw, but a kernel issue. However,     this feature has legitimate use cases and backporting     the specific kernel patch is too intrusive.
    Additionally, a local attacker requires the     CAP_SYS_ADMIN capability to abuse this functionality.
    Therefore, as a fix, a kernel version check has been     added to vsftpd in order to disable this feature for     kernels < 2.6.35.

  - CVE-2011-0762     Maksymilian Arciemowicz discovered that vsftpd is     incorrectly handling certain glob expressions in STAT     commands. This allows a remote authenticated attacker to     conduct denial of service attacks (excessive CPU and     process slot exhaustion) via crafted STAT commands.

ID	Name	Product	Family	Severity
217447	Linux Distros Unpatched Vulnerability : CVE-2011-2189	Nessus	Misc.	high
57038	Ubuntu 10.04 LTS / 10.10 / 11.04 / 11.10 : vsftpd vulnerability (USN-1288-1)	Nessus	Ubuntu Local Security Checks	high
56231	Debian DSA-2305-1 : vsftpd - denial of service	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2011-2189

high

Tenable Plugins

high

high

high