Bug 35978 - gssftp can be segfaulted remotely, possibly exploitable
Summary: gssftp can be segfaulted remotely, possibly exploitable
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Linux
Classification: Retired
Component: krb5   
(Show other bugs)
Version: 7.0
Hardware: i386 Linux
high
medium
Target Milestone: ---
Assignee: Nalin Dahyabhai
QA Contact: Brian Brock
URL:
Whiteboard:
Keywords: Security
: 37731 (view as bug list)
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2001-04-15 19:57 UTC by Mario Lorenz
Modified: 2007-03-27 03:43 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2001-05-15 15:49:19 UTC
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2001:060 normal SHIPPED_LIVE : Updated Kerberos 5 packages available 2001-04-26 04:00:00 UTC

Description Mario Lorenz 2001-04-15 19:57:58 UTC 
From Bugzilla Helper:
User-Agent: Mozilla/4.77 [de] (X11; U; Linux 2.2.19 i686)


kerberos-workstation includes kerberized ftp, gssftpd, which is not wu-ftpd
but the
BSD ftp. This FTP is possibly vulnerable to the GLOB attacks as described
in CERT
/Covert Labs Advisory recently. Also, plain "ls ~" gives you the FTP home
path, which
is considered bad (albeit highly predictable anyway on linux boxen)

Reproducible: Always
Steps to Reproduce:
1. Enable gssftp with chckconfig to allow kerberized FTP connections
2. Login to the ftp server using anonymous FTP
3. Type "cd ~*"
	

Actual Results:  421 service not available.
gdb attached to ftpd shows it segfaulted.


Expected Results:  Nothing

I am not 100% sure if this is exploitable, I didnt dig in that deep. Covert
Labs quote
exploitability under certain circumstances. Nevertheless, a remotely
induced segfault
is pretty bad.
Fortunately, the krb gssftp is probably not used widely.
Comment 1 Nalin Dahyabhai 2001-04-26 19:54:24 UTC 
*** Bug 37731 has been marked as a duplicate of this bug. ***
Comment 2 Mario Lorenz 2001-05-15 15:33:00 UTC 
Folks, you have had this for a whole month now.

A week after my initial report here, this came up on BugTraq and was labeled
REMOTE EXPLOITABLE. A fix was provided in the Bugtraq posting.

Since #37731 you knew the BugTraq post (and thats been 3 weeks ago as well)

It is therefore reasonable to state what seems obvious, and set the bug to
WONTFIX.
Comment 3 Matt Wilson 2001-05-15 15:44:51 UTC 
*sigh*
Comment 4 Nalin Dahyabhai 2001-06-27 05:31:03 UTC 
krb5-1.2.2-5 has been released as an errata.
Note You need to log in before you can comment on or make changes to this bug.