Description of problem: There is a memory leak that causes memory to be allocated but not freed. When the deny_file option is set, it is possible to easily exploit this. This is a regression caused by applied patch in bz174764. Problem also exists in FC-6, F-7, F-8 and fedora/devel. Attached is a patch to solve the problem. Version-Release number of selected component (if applicable): vsftpd-2.0.5-10.el5 How reproducible: always Steps to Reproduce: # echo deny_file=foo >> /etc/vsftpd/vsftpd.conf # service vsftpd restart $ cat > memtest.sh << EOF #!/bin/bash echo USER anonymous echo PASS foo while [ 1 ]; do echo CWD pub echo CWD .. done EOF $ chmod 700 memtest.sh $ ./memtest.sh | telnet localhost 21 > /dev/null Actual results: vsftpd starts to allocate memory that will never be freed. Expected results: Additional info: It is possible that the memory leak can be exploited by other means, or with other vsftpd.conf options. This was not investigated into more depth.
Created attachment 267651 [details] fix the vsftpd-2.0.4-filter.patch
This bugzilla has Keywords: Regression. Since no regressions are allowed between releases, it is also being proposed as a blocker for this release. Please resolve ASAP.
Created attachment 268841 [details] Just a cosmetic change.
moving to security response product so we can do tracking bugs for the affected rhel streams we decide are vulnerable and need to be fixed.
removing embargo ready for 5.2 release.
vsftpd-2.0.6-4.fc9 has been submitted as an update for Fedora 9
vsftpd-2.0.5-20.fc8 has been submitted as an update for Fedora 8
vsftpd-2.0.5-17.fc7 has been submitted as an update for Fedora 7
vsftpd-2.0.5-20.fc8 has been pushed to the Fedora 8 stable repository. If problems still persist, please make note of it in this bug report.
vsftpd-2.0.6-4.fc9 has been pushed to the Fedora 9 stable repository. If problems still persist, please make note of it in this bug report.
vsftpd-2.0.5-17.fc7 has been pushed to the Fedora 7 stable repository. If problems still persist, please make note of it in this bug report.
This issue was addressed in: Red Hat Enterprise Linux: http://rhn.redhat.com/errata/RHSA-2008-0295.html Fedora: https://admin.fedoraproject.org/updates/F8/FEDORA-2008-4347 https://admin.fedoraproject.org/updates/F9/FEDORA-2008-4362