Bug 704283 (CVE-2011-0418)

Summary:	CVE-2011-0418 pure-ftpd: GLOB_BRACE\|GLOB_LIMIT memory exhaustion
Product:	[Other] Security Response	Reporter:	Vincent Danen <vdanen>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	lkundrak, mi
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2013-04-05 18:07:32 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	704285, 704286
Bug Blocks:

Description Vincent Danen 2011-05-12 16:57:18 UTC

Multiple libc/glob(3) flaws were reported [1] that affect various *BSD libc implementations.  In particular, globs containing braces could lead to resource exhaustion.

One such vulnerable application is Pure-FTPd.  This has been corrected in upstream version 1.0.32, where support for braces expansion in directory listings was disabled.

[1] http://securityreason.com/achievement_securityalert/97
[2] http://www.pureftpd.org/project/pure-ftpd/news

Comment 1 Vincent Danen 2011-05-12 17:02:19 UTC

Created pure-ftpd tracking bugs for this issue

Affects: fedora-all [bug 704285]
Affects: epel-all [bug 704286]

Comment 2 Vincent Danen 2012-05-16 14:41:24 UTC

Fedora currently ships the fixed 1.0.32 in each supported release.

EPEL5 is not corrected (1.0.29) and EPEL6 is not corrected (1.0.30).