CVE-2015-5917

NONE EPSS 84.3%

Published Oct 9, 201510y ago · Modified Jun 17, 20262w ago

Published Oct 9, 2015 10y ago

Last Modified Jun 17, 2026 2w ago

Description

The glob implementation in tnftpd (formerly lukemftpd), as used in Apple OS X before 10.11, allows remote attackers to cause a denial of service (memory consumption and daemon outage) via a STAT command containing a crafted pattern, as demonstrated by multiple instances of the {..,..,..}/* substring.

Threat Intelligence

EPSS Exploit Probability

84.3% percentile

Exploit & Patch Status

Public Exploit Known

No Patch Available

Weaknesses 1

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer Memory Safety

Affected Products 2

Vendor	Product	Version	Range
netbsd	tnftpd	*	any
apple	mac_os_x	10.10.5	any

References 6

lists.apple.com http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html

Vendor Advisory
securityfocus.com http://www.securityfocus.com/bid/76908
securitytracker.com http://www.securitytracker.com/id/1033703
cxsecurity.com https://cxsecurity.com/issue/WLB-2013040082
support.apple.com https://support.apple.com/HT205267

Vendor Advisory
youtube.com https://www.youtube.com/watch?v=MBK4QYkUm10

Exploit

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.