Bug 397011 - (CVE-2007-5962) CVE-2007-5962 vsftpd: memory leak when deny_file option is set
CVE-2007-5962 vsftpd: memory leak when deny_file option is set
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
low Severity low
: ---
: ---
Assigned To: Martin Nagy
source=redhat,reported=20071123,publi...
: Patch, Regression, Security
Depends On: 423001
Blocks:
  Show dependency treegraph
 
Reported: 2007-11-23 10:51 EST by Martin Nagy
Modified: 2016-07-26 19:47 EDT (History)
3 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2008-07-21 05:40:00 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)
fix the vsftpd-2.0.4-filter.patch (382 bytes, patch)
2007-11-23 10:51 EST, Martin Nagy
no flags Details | Diff
Just a cosmetic change. (369 bytes, patch)
2007-11-26 06:28 EST, Martin Nagy
no flags Details | Diff

  None (edit)
Description Martin Nagy 2007-11-23 10:51:42 EST
Description of problem:
There is a memory leak that causes memory to be allocated but not freed.
When the deny_file option is set, it is possible to easily exploit this.
This is a regression caused by applied patch in bz174764. Problem also
exists in FC-6, F-7, F-8 and fedora/devel. Attached is a patch to solve
the problem.

Version-Release number of selected component (if applicable):
vsftpd-2.0.5-10.el5

How reproducible:
always

Steps to Reproduce:
# echo deny_file=foo >> /etc/vsftpd/vsftpd.conf
# service vsftpd restart

$ cat > memtest.sh << EOF
#!/bin/bash
echo USER anonymous
echo PASS foo@bar.com

while [ 1 ]; do
        echo CWD pub
        echo CWD ..
done
EOF

$ chmod 700 memtest.sh
$ ./memtest.sh | telnet localhost 21 > /dev/null

Actual results:
vsftpd starts to allocate memory that will never be freed.

Expected results:


Additional info:
It is possible that the memory leak can be exploited by other means, or
with other vsftpd.conf options. This was not investigated into more depth.
Comment 1 Martin Nagy 2007-11-23 10:51:42 EST
Created attachment 267651 [details]
fix the vsftpd-2.0.4-filter.patch
Comment 2 RHEL Product and Program Management 2007-11-23 11:05:19 EST
This bugzilla has Keywords: Regression.  

Since no regressions are allowed between releases, 
it is also being proposed as a blocker for this release.  

Please resolve ASAP.
Comment 3 Martin Nagy 2007-11-26 06:28:37 EST
Created attachment 268841 [details]
Just a cosmetic change.
Comment 4 Mark J. Cox (Product Security) 2007-11-27 06:36:33 EST
moving to security response product so we can do tracking bugs for the affected
rhel streams we decide are vulnerable and need to be fixed.
Comment 9 Mark J. Cox (Product Security) 2008-05-21 08:51:50 EDT
removing embargo ready for 5.2 release.
Comment 10 Fedora Update System 2008-05-21 10:04:19 EDT
vsftpd-2.0.6-4.fc9 has been submitted as an update for Fedora 9
Comment 11 Fedora Update System 2008-05-21 10:05:20 EDT
vsftpd-2.0.5-20.fc8 has been submitted as an update for Fedora 8
Comment 12 Fedora Update System 2008-05-21 10:05:56 EDT
vsftpd-2.0.5-17.fc7 has been submitted as an update for Fedora 7
Comment 13 Fedora Update System 2008-05-22 16:37:20 EDT
vsftpd-2.0.5-20.fc8 has been pushed to the Fedora 8 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 14 Fedora Update System 2008-05-22 16:37:59 EDT
vsftpd-2.0.6-4.fc9 has been pushed to the Fedora 9 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 15 Fedora Update System 2008-05-22 16:38:18 EDT
vsftpd-2.0.5-17.fc7 has been pushed to the Fedora 7 stable repository.  If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.