CVE-2008-2375 (GCVE-0-2008-2375)
Vulnerability from cvelistv5 – Published: 2008-07-09 00:00 – Updated: 2024-08-07 08:58
VLAI?
Summary
Memory leak in a certain Red Hat deployment of vsftpd before 2.0.5 on Red Hat Enterprise Linux (RHEL) 3 and 4, when PAM is used, allows remote attackers to cause a denial of service (memory consumption) via a large number of invalid authentication attempts within the same session, a different vulnerability than CVE-2007-5962.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T08:58:02.466Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "ADV-2008-2820",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2008/2820"
},
{
"name": "30364",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/30364"
},
{
"name": "RHSA-2008:0680",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://www.redhat.com/support/errata/RHSA-2008-0680.html"
},
{
"name": "oval:org.mitre.oval:def:10138",
"tags": [
"vdb-entry",
"signature",
"x_refsource_OVAL",
"x_transferred"
],
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10138"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/attachment.cgi?id=201051"
},
{
"name": "RHSA-2008:0579",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://www.redhat.com/support/errata/RHSA-2008-0579.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://support.avaya.com/elmodocs2/security/ASA-2008-398.htm"
},
{
"name": "31223",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/31223"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://wiki.rpath.com/Advisories:rPSA-2008-0217"
},
{
"name": "31007",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/31007"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://issues.rpath.com/browse/RPL-2640"
},
{
"name": "1020546",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id?1020546"
},
{
"name": "32263",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/32263"
},
{
"name": "20080708 rPSA-2008-0217-1 vsftpd",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/494081/100/0/threaded"
},
{
"name": "[oss-security] 20080630 CVE-2008-2375 older vsftpd authentication memory leak",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2008/06/30/2"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2008-06-30T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Memory leak in a certain Red Hat deployment of vsftpd before 2.0.5 on Red Hat Enterprise Linux (RHEL) 3 and 4, when PAM is used, allows remote attackers to cause a denial of service (memory consumption) via a large number of invalid authentication attempts within the same session, a different vulnerability than CVE-2007-5962."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-11T19:57:01",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "ADV-2008-2820",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2008/2820"
},
{
"name": "30364",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/30364"
},
{
"name": "RHSA-2008:0680",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://www.redhat.com/support/errata/RHSA-2008-0680.html"
},
{
"name": "oval:org.mitre.oval:def:10138",
"tags": [
"vdb-entry",
"signature",
"x_refsource_OVAL"
],
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10138"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugzilla.redhat.com/attachment.cgi?id=201051"
},
{
"name": "RHSA-2008:0579",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://www.redhat.com/support/errata/RHSA-2008-0579.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://support.avaya.com/elmodocs2/security/ASA-2008-398.htm"
},
{
"name": "31223",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/31223"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://wiki.rpath.com/Advisories:rPSA-2008-0217"
},
{
"name": "31007",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/31007"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://issues.rpath.com/browse/RPL-2640"
},
{
"name": "1020546",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id?1020546"
},
{
"name": "32263",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/32263"
},
{
"name": "20080708 rPSA-2008-0217-1 vsftpd",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/494081/100/0/threaded"
},
{
"name": "[oss-security] 20080630 CVE-2008-2375 older vsftpd authentication memory leak",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2008/06/30/2"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2008-2375",
"datePublished": "2008-07-09T00:00:00",
"dateReserved": "2008-05-21T00:00:00",
"dateUpdated": "2024-08-07T08:58:02.466Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2008-2375\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2008-07-09T00:41:00.000\",\"lastModified\":\"2025-04-09T00:30:58.490\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Memory leak in a certain Red Hat deployment of vsftpd before 2.0.5 on Red Hat Enterprise Linux (RHEL) 3 and 4, when PAM is used, allows remote attackers to cause a denial of service (memory consumption) via a large number of invalid authentication attempts within the same session, a different vulnerability than CVE-2007-5962.\"},{\"lang\":\"es\",\"value\":\"Fuga de memoria en cierta implementaci\u00f3n de Red Hat de vsftpd anterior a 2.0.5 en Red Hat Enterprise Linux (RHEL) 3 y 4, cuando se utiliza PAM, permite a atacantes remotos provocar una denegaci\u00f3n de servicio (consumo de memoria) mediante un gran n\u00famero de intentos de autenticaci\u00f3n no v\u00e1lidos en la misma sesi\u00f3n. Se trata de una vulnerabilidad diferente de CVE-2007-5962.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:N/I:N/A:C\",\"baseScore\":7.1,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"COMPLETE\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":8.6,\"impactScore\":6.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-399\"},{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux:3.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"40D8DAE0-8E75-435C-9BD6-FAEED2ACB47C\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux:4.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6172AF57-B26D-45F8-BE3A-F75ABDF28F49\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:vsftpd:0.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F425AD1B-0D85-4294-9E9F-3EC1EFE0B658\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:vsftpd:0.0.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D305ED07-C6C8-437F-9B32-0E4A3AEEA3DA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:vsftpd:0.0.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A9E40C59-2A21-4CC5-BADA-AFB46386ADCD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:vsftpd:0.0.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"21DC1316-FF41-49F3-BF0C-09E0CFF70AE2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:vsftpd:0.0.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C6D4739B-BA4D-4D58-8C0C-F4DA1AC09D51\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:vsftpd:0.0.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"79542EF5-EEED-4FBE-8722-D07907942643\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:vsftpd:0.0.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"87C483DE-8DC5-4A74-8F7F-DB30AD63BB20\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:vsftpd:0.0.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7A24362D-12C1-4121-9E40-EA3A67A8BF82\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:vsftpd:0.0.9:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"36708BE2-A437-4FF1-9A1E-772765C8FD5F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:vsftpd:0.0.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA26B597-CA83-4F62-90DF-CC103395B412\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:vsftpd:0.0.11:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"64B83EAF-BE04-4DA4-B868-2A15B0D0C5BB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:vsftpd:0.0.12:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2B27B315-0C20-49F7-B638-E27C677CBAF4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:vsftpd:0.0.13:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2FF5AC4C-397E-4AF7-846F-CAA72E93DA72\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:vsftpd:0.0.14:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5001819C-C4DF-444D-945C-2577AD91A014\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:vsftpd:0.0.15:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DA3FCFD0-A79F-447E-B5CF-7CF599E9BFDF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:vsftpd:0.9.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"05DC66F1-ECC4-47AD-8F47-135FDA2E0A68\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:vsftpd:0.9.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5EBF66A8-685E-4357-BC8C-D9E8CBFED91A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:vsftpd:0.9.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CFBEABE0-DA68-4037-B044-0DD8E83A21F3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:vsftpd:0.9.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"160A31D8-A7B2-425A-9D7F-124575D18825\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:vsftpd:1.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4D266656-4DAD-4FA6-9874-21CA15952AB4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:vsftpd:1.1.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"42FBD1A1-CB90-4EE8-B192-2659AA3F961B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:vsftpd:1.1.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3D50A535-D0C4-4A88-A6E3-23830B82BC29\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:vsftpd:1.1.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"97626749-3A3C-4F91-971B-01CB01ED285A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:vsftpd:1.2.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"38A8564D-8301-4F77-8349-06A723F20C1B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:vsftpd:1.2.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"88280371-39DB-45B5-BC79-85B05984123B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:vsftpd:1.2.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F149C664-511D-497F-84F7-90D9214F9E57\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:vsftpd:2.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1EDDC295-24D7-4E8B-A681-FD8099B1F1E4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:vsftpd:2.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FB23F46F-C33B-4CEA-AC7D-2A517A54D199\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:vsftpd:2.0.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5B403417-3384-4E0E-A20A-F11D3572533D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:vsftpd:2.0.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C0D786E6-7D73-45D1-88D8-2966E5FD237F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:vsftpd:2.0.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"54922D08-A055-41EE-A818-BD3E6FA85494\"}]}]}],\"references\":[{\"url\":\"http://secunia.com/advisories/31007\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://secunia.com/advisories/31223\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://secunia.com/advisories/32263\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://support.avaya.com/elmodocs2/security/ASA-2008-398.htm\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://wiki.rpath.com/Advisories:rPSA-2008-0217\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.openwall.com/lists/oss-security/2008/06/30/2\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.redhat.com/support/errata/RHSA-2008-0579.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.redhat.com/support/errata/RHSA-2008-0680.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.securityfocus.com/archive/1/494081/100/0/threaded\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.securityfocus.com/bid/30364\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.securitytracker.com/id?1020546\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.vupen.com/english/advisories/2008/2820\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://bugzilla.redhat.com/attachment.cgi?id=201051\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Exploit\"]},{\"url\":\"https://issues.rpath.com/browse/RPL-2640\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10138\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://secunia.com/advisories/31007\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://secunia.com/advisories/31223\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://secunia.com/advisories/32263\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://support.avaya.com/elmodocs2/security/ASA-2008-398.htm\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://wiki.rpath.com/Advisories:rPSA-2008-0217\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.openwall.com/lists/oss-security/2008/06/30/2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.redhat.com/support/errata/RHSA-2008-0579.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.redhat.com/support/errata/RHSA-2008-0680.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securityfocus.com/archive/1/494081/100/0/threaded\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securityfocus.com/bid/30364\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securitytracker.com/id?1020546\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.vupen.com/english/advisories/2008/2820\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://bugzilla.redhat.com/attachment.cgi?id=201051\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\"]},{\"url\":\"https://issues.rpath.com/browse/RPL-2640\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10138\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…