Denial of Service in vsftpd
Summary
CVE-2004-2259: vsftpd before 1.2.2, when under heavy load, allows attackers to cause a denial of service (crash) via a SIGCHLD signal during a malloc or free call, which is not re-entrant. Affects vsftpd versions < 2.0.1-1. Fixed in 2.0.1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
vsftpd is an FTP server for Unix-like systems. It is known for its security, performance, and simplicity. The vsftpd package is available for various Debian distributions, including Debian 10, 11, 12, and 13. This vulnerability affects vsftpd versions before 1.2.2 under heavy load.
Vulnerability Detail
The vulnerability, identified as CVE-2004-2259, allows attackers to cause a denial of service (crash) in vsftpd. This can be achieved by sending a SIGCHLD signal during a malloc or free call, which is not re-entrant. The impact of this vulnerability is a crash of the vsftpd service, leading to a disruption in FTP functionality.
How To Fix
Minimum fixed version
2.0.1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade vsftpdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, the vsftpd FTP server is vulnerable to a denial of service attack under heavy load. To mitigate this vulnerability, it is recommended to update the vsftpd package to version 2.0.1-1 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for vsftpd →
FAQ
vsftpd is an FTP server for Unix-like systems known for its security, performance, and simplicity.
The vulnerability allows attackers to cause a denial of service (crash) in vsftpd, resulting in a disruption of FTP functionality.
Versions of vsftpd before 1.2.2 are affected by this vulnerability.
To fix this vulnerability, update the vsftpd package to version 2.0.1-1 or later.
No specific workaround has been mentioned for this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for vsftpd.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
