Bug 111573 – net-ftp/ftpd: remote hole in linux-ftpd-ssl (CVE-2005-3524)

• Product: Gentoo Security
• Status: RESOLVED FIXED

[Description Wernfried Haas (RETIRED) 2005-11-05 10:08:22 UTC]

http://seclists.org/lists/fulldisclosure/2005/Nov/0140.html describes a hole in
linux-ftpd-ssl. I don't know if the exploit works and i'm not even sure if it
even affects Gentoo, but there's 
*  net-ftp/ftpd
      Latest version available: 0.17-r1
      Description: The netkit FTP server with optional SSL support
in portage. I assume this could be the same ftpd the mail is about. If not -
sorry for the waste of time. ;-)

Reproducible: Always
Steps to Reproduce:

[Comment 1 Tavis Ormandy (RETIRED) 2005-11-05 11:05:32 UTC]

Looks for real, the vsprintf in reply() looks like the target.

[Comment 2 James Longstreet 2005-11-05 15:16:43 UTC]

Created attachment 72248 [details, diff]
fixes BOF in reply() in ftpd.c ssl version - vsprintf to vsnprintf

simple patch, apply after applying linux-ftpd-0.17+ssl-0.3.diff.

[Comment 3 Thierry Carrez (RETIRED) 2005-11-06 02:46:43 UTC]

No maintainer, security should patch it asap.

[Comment 4 Thierry Carrez (RETIRED) 2005-11-06 02:57:54 UTC]

Downgrading as it needs some kind of power-user access (ftp user with write
access). Should still be patched though :)

[Comment 5 Daniel Black (RETIRED) 2005-11-06 04:31:49 UTC]

ftpd-0.17-r2 added with minimal testing 

[Comment 6 solar (RETIRED) 2005-11-06 06:55:14 UTC]

Created attachment 72306 [details, diff]
linux-ftpd-0.17-ssl.patch

The ssl patch in general is pretty messy and there are lots of assumptions made

with buffers. Lots of code in the addon patch was simply #if 0 .. #endif which 

made up for alot of it's size. The patch is also in $FILESDIR is also
compressed. 
(more slop) We need to move that out of there and onto the mirrors with a
proper 
name. Attached is a smaller untested patch which cleans up things I did not
care 
for/trust with the patch/pkg in question.

[Comment 7 Sune Kloppenborg Jeppesen (RETIRED) 2005-11-06 08:02:31 UTC]

Daniel, is -r2 ready to be marked stable otherwise plase provide an updated 
ebuild.  

[Comment 8 Daniel Black (RETIRED) 2005-11-09 13:37:46 UTC]

ftpd-0.17-r3 ready thanks to Ned  

[Comment 9 Mark Loeser (RETIRED) 2005-11-09 18:16:59 UTC]

Stable on x86 

[Comment 10 Jason Wever (RETIRED) 2005-11-09 19:19:29 UTC]

Keep on SPARCin'

[Comment 11 Jose Luis Rivero (yoswink) (RETIRED) 2005-11-10 14:24:00 UTC]

alpha stable. 

[Comment 12 Simon Stelling (RETIRED) 2005-11-11 07:44:17 UTC]

amd64 stable

[Comment 13 Thierry Carrez (RETIRED) 2005-11-13 09:59:00 UTC]

GLSA 200511-11