Two vulnerabilities have been identified in fileutils and coreutils, which can be exploited by malicious users to cause a DoS (Denial of Service).

It is possible to cause the "ls" and "dir" programs to consume large amounts of memory by supplying an overly large integer value as argument to the "-w" parameter.

Successful exploitation results in an integer overflow but this is reportedly not believed to be exploitable for command execution.

The vulnerabilities can also be triggered remotely via applications calling "ls" or "dir" without filtering input (eg. via WU-FTPD).

Solution
Update to Coreutils version 5.2.0.
Further details available to Secunia VIM customers

Provided and/or discovered by
Georgi Guninski
Shaun Colley (integer overflow in "dir")

Changelog
Further details available to Secunia VIM customers

Original Advisory
Georgi Guninski security advisory #62:
http://www.guninski.com/binls.html

Deep Links
Links available to Secunia VIM customers