Red Hat Bugzilla – Bug 397011
CVE-2007-5962 vsftpd: memory leak when deny_file option is set
Last modified: 2016-03-04 06:11:22 EST
Description of problem:
There is a memory leak that causes memory to be allocated but not freed.
When the deny_file option is set, it is possible to easily exploit this.
This is a regression caused by applied patch in bz174764. Problem also
exists in FC-6, F-7, F-8 and fedora/devel. Attached is a patch to solve
Version-Release number of selected component (if applicable):
Steps to Reproduce:
# echo deny_file=foo >> /etc/vsftpd/vsftpd.conf
# service vsftpd restart
$ cat > memtest.sh << EOF
echo USER anonymous
echo PASS firstname.lastname@example.org
while [ 1 ]; do
echo CWD pub
echo CWD ..
$ chmod 700 memtest.sh
$ ./memtest.sh | telnet localhost 21 > /dev/null
vsftpd starts to allocate memory that will never be freed.
It is possible that the memory leak can be exploited by other means, or
with other vsftpd.conf options. This was not investigated into more depth.
Created attachment 267651 [details]
fix the vsftpd-2.0.4-filter.patch
This bugzilla has Keywords: Regression.
Since no regressions are allowed between releases,
it is also being proposed as a blocker for this release.
Please resolve ASAP.
Created attachment 268841 [details]
Just a cosmetic change.
moving to security response product so we can do tracking bugs for the affected
rhel streams we decide are vulnerable and need to be fixed.
removing embargo ready for 5.2 release.
vsftpd-2.0.6-4.fc9 has been submitted as an update for Fedora 9
vsftpd-2.0.5-20.fc8 has been submitted as an update for Fedora 8
vsftpd-2.0.5-17.fc7 has been submitted as an update for Fedora 7
vsftpd-2.0.5-20.fc8 has been pushed to the Fedora 8 stable repository. If problems still persist, please make note of it in this bug report.
vsftpd-2.0.6-4.fc9 has been pushed to the Fedora 9 stable repository. If problems still persist, please make note of it in this bug report.
vsftpd-2.0.5-17.fc7 has been pushed to the Fedora 7 stable repository. If problems still persist, please make note of it in this bug report.
This issue was addressed in:
Red Hat Enterprise Linux: