lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Thu, 11 Apr 2013 07:43:23 +0200
From: "[CXSEC]" <>
Subject: MacOSX 10.8.3 ftpd Remote Resource Exhaustion

MacOSX 10.8.3 ftpd Remote Resource Exhaustion
Maksymilian Arciemowicz

Public Date: 01.02.2013

--- 1. Description ---
Old vulnerability in libc allow to denial of service ftpd in MacOSX 10.8.3.
Officially Apple has resolved this issue in Jun 2011. Apple use tnftpd as a
main ftp server. tnftpd has migrated some functions from libc to own code
(including glob(3)).  Missing patch for resource exhaustion was added in
version 20130322.

To this time, we can use CVE-2010-2632 to denial of service the ftp server.
The funniest is report

where CVE-2010-2632 was patched. That true 'libc is patched', but nobody
from Apple has verified ftp. I really don't believe in penetrating testing
form Apple side. Situation don't seems good. I has asked for open source
donations,  unfortunately Apple do not financial help vendors, what use
their software in own products.

Proof of Concept is available since 2010

Video demonstrated how to kill Mac Mini in basic version i5 with 10GB RAM
in 30 min is available on

--- 2. References ---
Multiple Vendors libc/glob(3) remote ftpd resource exhaustion

Multiple FTPD Server GLOB_BRACE|GLOB_LIMIT memory exhaustion

More CWE-399 resource exhaustion examples:

Last related to

--- 3. Contact ---
Maksymilian Arciemowicz

Best regards,

Content of type "text/html" skipped

Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia -

Powered by blists - more mailing lists