CVE-2003-0854
published 2003-11-17CVE-2003-0854: ls in the fileutils or coreutils packages allows local users to consume a large amount of memory via a large -w value, which can be remotely exploited via…
PriorityP411low2.1CVSS 2.0
AVLACLAuNCNINAP
EXPLOIT
EPSS
1.06%
60.7th percentile
ls in the fileutils or coreutils packages allows local users to consume a large amount of memory via a large -w value, which can be remotely exploited via applications that use ls, such as wu-ftpd.
Affected
31 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | coreutils | < coreutils 5.2.1-1 (bookworm) | coreutils 5.2.1-1 (bookworm) |
| gnu | coreutils | >= 0 < 5.2.1-1 | 5.2.1-1 |
| gnu | coreutils | >= 0 < 5.2.1-1 | 5.2.1-1 |
| gnu | coreutils | >= 0 < 5.2.1-1 | 5.2.1-1 |
| gnu | coreutils | >= 0 < 5.2.1-1 | 5.2.1-1 |
| gnu | fileutils | — | — |
| gnu | fileutils | — | — |
| gnu | fileutils | — | — |
| gnu | fileutils | — | — |
| gnu | fileutils | — | — |
| washington_university | wu-ftpd | — | — |
| washington_university | wu-ftpd | — | — |
| washington_university | wu-ftpd | — | — |
| washington_university | wu-ftpd | — | — |
| washington_university | wu-ftpd | — | — |
| washington_university | wu-ftpd | — | — |
| washington_university | wu-ftpd | — | — |
| washington_university | wu-ftpd | — | — |
| washington_university | wu-ftpd | — | — |
| washington_university | wu-ftpd | — | — |
| washington_university | wu-ftpd | — | — |
| washington_university | wu-ftpd | — | — |
| washington_university | wu-ftpd | — | — |
| washington_university | wu-ftpd | — | — |
| washington_university | wu-ftpd | — | — |
CVSS provenance
nvdv2.02.1LOWAV:L/AC:L/Au:N/C:N/I:N/A:P
osv2.1LOW
vendor_debian2.1LOW
vendor_redhat2.1LOW
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
security flaw
vendor_redhat·2003-10-15·CVSS 2.1
CVE-2003-0854 [LOW] security flaw
security flaw
ls in the fileutils or coreutils packages allows local users to consume a large amount of memory via a large -w value, which can be remotely exploited via applications that use ls, such as wu-ftpd.
Debian
CVE-2003-0854: coreutils - ls in the fileutils or coreutils packages allows local users to consume a large ...
vendor_debian·2003·CVSS 2.1
CVE-2003-0854 [LOW] CVE-2003-0854: coreutils - ls in the fileutils or coreutils packages allows local users to consume a large ...
ls in the fileutils or coreutils packages allows local users to consume a large amount of memory via a large -w value, which can be remotely exploited via applications that use ls, such as wu-ftpd.
Scope: local
bookworm: resolved (fixed in 5.2.1-1)
bullseye: resolved (fixed in 5.2.1-1)
forky: resolved (fixed in 5.2.1-1)
sid: resolved (fixed in 5.2.1-1)
trixie: resolved (fixed in 5.2.1-1)
GHSA
GHSA-qjv8-gc24-r5w4: ls in the fileutils or coreutils packages allows local users to consume a large amount of memory via a large -w value, which can be remotely exploited
ghsa_unreviewed·2022-04-29
CVE-2003-0854 [LOW] GHSA-qjv8-gc24-r5w4: ls in the fileutils or coreutils packages allows local users to consume a large amount of memory via a large -w value, which can be remotely exploited
ls in the fileutils or coreutils packages allows local users to consume a large amount of memory via a large -w value, which can be remotely exploited via applications that use ls, such as wu-ftpd.
OSV
CVE-2003-0854: ls in the fileutils or coreutils packages allows local users to consume a large amount of memory via a large -w value, which can be remotely exploited
osv·2003-11-17·CVSS 2.1
CVE-2003-0854 [LOW] CVE-2003-0854: ls in the fileutils or coreutils packages allows local users to consume a large amount of memory via a large -w value, which can be remotely exploited
ls in the fileutils or coreutils packages allows local users to consume a large amount of memory via a large -w value, which can be remotely exploited via applications that use ls, such as wu-ftpd.
No detection rules found.
Bugzilla
CVE-2003-0854 security flaw
bugzilla·2018-08-16·CVSS 2.1
CVE-2003-0854 [LOW] CVE-2003-0854 security flaw
CVE-2003-0854 security flaw
Flaw bug created to hold information about an old flaw we knew something about. For more details see the MITRE CVE description.
Discussion:
MITRE description:
ls in the fileutils or coreutils packages allows local users to consume a large amount of memory via a large -w value, which can be remotely exploited via applications that use ls, such as wu-ftpd.
Bugzilla
CAN-2003-0853/0854 DoS in services that use "ls"
bugzilla·2003-10-23
[MEDIUM] CAN-2003-0853/0854 DoS in services that use "ls"
CAN-2003-0853/0854 DoS in services that use "ls"
Georgi Guninski discovered a memory starvation denial of service
vulnerability in the ls program. It is possible to make ls allocate a
huge amount of memory by specifing certain command line arguments. This
vulnerability is remotely exploitable through services like wu-ftpd which
pass user arguments to ls. The Common Vulnerabilities and Exposures
project (cve.mitre.org) has assigned the name CAN-2003-0854 to this issue.
A non-exploitable integer overflow in ls has been discovered. It is
possible to make ls crash by specifing certain command line arguments.
This vulnerability is remotely exploitable through services like wu-ftpd
which pass user arguments to ls. The Common Vulnerabilities and Exposures
project (cve.mitre.org) has assigned th
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000768http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000771http://lists.grok.org.uk/pipermail/full-disclosure/2003-October/012548.htmlhttp://secunia.com/advisories/10126http://secunia.com/advisories/17069http://support.avaya.com/elmodocs2/security/ASA-2005-213.pdfhttp://www.debian.org/security/2005/dsa-705http://www.guninski.com/binls.htmlhttp://www.mandriva.com/security/advisories?name=MDKSA-2003:106http://www.redhat.com/support/errata/RHSA-2003-309.htmlhttp://www.redhat.com/support/errata/RHSA-2003-310.htmlhttp://www.securityfocus.com/advisories/6014http://www.turbolinux.com/security/TLSA-2003-60.txthttps://www.exploit-db.com/exploits/115http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000768http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000771http://lists.grok.org.uk/pipermail/full-disclosure/2003-October/012548.htmlhttp://secunia.com/advisories/10126http://secunia.com/advisories/17069http://support.avaya.com/elmodocs2/security/ASA-2005-213.pdfhttp://www.debian.org/security/2005/dsa-705http://www.guninski.com/binls.htmlhttp://www.mandriva.com/security/advisories?name=MDKSA-2003:106http://www.redhat.com/support/errata/RHSA-2003-309.htmlhttp://www.redhat.com/support/errata/RHSA-2003-310.htmlhttp://www.securityfocus.com/advisories/6014http://www.turbolinux.com/security/TLSA-2003-60.txthttps://www.exploit-db.com/exploits/115
2003-11-17
Published