Analyst readout for executives and security teams
Plain-English summary
CVE-2001-0965 is an old denial-of-service issue in glFTPD 1.23. A remote user can trigger excessive CPU use through a crafted LIST request. The business impact is FTP service degradation or outage, not data theft or code execution based on the supplied sources.
Executive priority
Prioritize if glFTPD 1.23 is internet-facing or supports critical file-transfer workflows. Otherwise, handle through legacy-system cleanup and exposure reduction, because supplied evidence indicates denial of service rather than compromise.
Technical view
The flaw affects glFTPD 1.23 and involves CPU exhaustion when processing a LIST command argument containing many asterisk characters. The source bundle provides no CVSS score, CWE, patch version, or broad affected-product metadata beyond glFTPD 1.23.
Likely exposure
Exposure is likely limited to environments still running glFTPD 1.23, especially internet-facing FTP services. The supplied affected-product metadata is incomplete and does not identify operating systems, package names, or downstream distributions.
Exploitation context
The sources describe a remote denial-of-service condition, but the bundle does not show CISA KEV listing or confirmed active exploitation. Treat this as a service-availability risk for legacy FTP deployments, not evidence of current exploitation.
Researcher notes
The record is sparse: no CVSS, CWE, fixed-version statement, or detailed affected CPEs are provided. Preserve the distinction between the described LIST parsing CPU exhaustion and any unrelated glFTPD vulnerabilities.
Mitigation direction
- Inventory FTP services and identify any glFTPD 1.23 instances.
- Check glFTPD vendor or maintainer guidance for fixed versions or retirement advice.
- Restrict FTP exposure to trusted networks where business requirements allow.
- Monitor for abnormal LIST usage and CPU spikes on FTP hosts.
- Plan replacement if glFTPD 1.23 remains in production.
Validation and detection
- Confirm whether any FTP banners, configs, or asset records identify glFTPD 1.23.
- Review FTP logs for LIST requests with unusually long asterisk-heavy arguments.
- Check host telemetry for CPU saturation correlated with FTP sessions.
- Verify exposed FTP endpoints are intentionally reachable from untrusted networks.
Public sources used
Based on public source material and reviewed before publication.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2001-0965 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- 3201CVE reference · vdb-entry, x_refsource_BID
- http://www.glftpd.org/CVE reference · x_refsource_CONFIRM
- glftpd-list-dos(7001)CVE reference · vdb-entry, x_refsource_XF
- 20010817 [ASGUARD-LABS] glFTPD v1.23 DOS AttackCVE reference · mailing-list, x_refsource_BUGTRAQ
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.