Bug 35978 - gssftp can be segfaulted remotely, possibly exploitable
Summary: gssftp can be segfaulted remotely, possibly exploitable
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Linux
Classification: Retired
Component: krb5
Version: 7.0
Hardware: i386
OS: Linux
high
medium
Target Milestone: ---
Assignee: Nalin Dahyabhai
QA Contact: Brian Brock
URL:
Whiteboard:
: 37731 (view as bug list)
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2001-04-15 19:57 UTC by Mario Lorenz
Modified: 2007-03-27 03:43 UTC (History)
1 user (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2001-05-15 15:49:19 UTC
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2001:060 0 normal SHIPPED_LIVE : Updated Kerberos 5 packages available 2001-04-26 04:00:00 UTC

Description Mario Lorenz 2001-04-15 19:57:58 UTC
From Bugzilla Helper:
User-Agent: Mozilla/4.77 [de] (X11; U; Linux 2.2.19 i686)


kerberos-workstation includes kerberized ftp, gssftpd, which is not wu-ftpd
but the
BSD ftp. This FTP is possibly vulnerable to the GLOB attacks as described
in CERT
/Covert Labs Advisory recently. Also, plain "ls ~" gives you the FTP home
path, which
is considered bad (albeit highly predictable anyway on linux boxen)

Reproducible: Always
Steps to Reproduce:
1. Enable gssftp with chckconfig to allow kerberized FTP connections
2. Login to the ftp server using anonymous FTP
3. Type "cd ~*"
	

Actual Results:  421 service not available.
gdb attached to ftpd shows it segfaulted.


Expected Results:  Nothing

I am not 100% sure if this is exploitable, I didnt dig in that deep. Covert
Labs quote
exploitability under certain circumstances. Nevertheless, a remotely
induced segfault
is pretty bad.
Fortunately, the krb gssftp is probably not used widely.

Comment 1 Nalin Dahyabhai 2001-04-26 19:54:24 UTC
*** Bug 37731 has been marked as a duplicate of this bug. ***

Comment 2 Mario Lorenz 2001-05-15 15:33:00 UTC
Folks, you have had this for a whole month now.

A week after my initial report here, this came up on BugTraq and was labeled
REMOTE EXPLOITABLE. A fix was provided in the Bugtraq posting.

Since #37731 you knew the BugTraq post (and thats been 3 weeks ago as well)

It is therefore reasonable to state what seems obvious, and set the bug to
WONTFIX.



Comment 3 Matt Wilson 2001-05-15 15:44:51 UTC
*sigh*


Comment 4 Nalin Dahyabhai 2001-06-27 05:31:03 UTC
krb5-1.2.2-5 has been released as an errata.


Note You need to log in before you can comment on or make changes to this bug.