Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 54590

Summary: net-ftp/pure-ftpd-1.0.19 fixes DoS when max connections is reached
Product: Gentoo Security Reporter: Jeremy Kitchen <jeremy>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Status: RESOLVED FIXED    
Severity: minor CC: chriswhite, grandmasterlinux, ppc
Priority: High    
Version: unspecified   
Hardware: All   
OS: Linux   
URL: http://scriptkitchen.com/pureftpd/pure-ml1.txt
Whiteboard: B3 [glsa]
Package list:
Runtime testing required: ---

Description Jeremy Kitchen 2004-06-20 20:46:34 UTC
as shown in the following two emails to the pure-ftpd mailing list (list@pureftpd.org), there is a denial of service attack possible against pureftpd.

http://scriptkitchen.com/pureftpd/pure-ml1.txt
http://scriptkitchen.com/pureftpd/pure-ml2.txt

(Sorry, I don't know of any mailing list archives that have this, these are from  my server)

Fix: upgrade to 1.0.19.  I'd submit a patch, but there were quite a few changes between the two versions, and I'm not sure which one(s) is(are) applicable.

I don't think this happens in inetd mode (not confirmed), but since gentoo's pure-ftpd uses daemon mode, it applies here.

Not sure if this is the entire thing, but assuming based on what the ChangeLog says, this is a patch that should encompass the change (for backporting purposes, etc)

http://scriptkitchen.com/pureftpd/pure-ftpd-glsa.patch
I applied it against my pure-ftpd 1.0.18 source with patch -p1, and it built properly and was functional.

Reproducible: Always
Steps to Reproduce:
Comment 1 Jeremy Kitchen 2004-06-20 20:54:06 UTC
err... duh.  Sorry, I switched gears mid-post and decided to submit a patch, but didn't change the "I'd submit a patch" part.

my bad :)
Comment 2 solar (RETIRED) gentoo-dev 2004-06-20 21:26:04 UTC
raker, 
I could not get this one to bump local with the USE=ldap flag or apply the patch. 
Not sure if others are having (will have) that problem or not.
Comment 3 solar (RETIRED) gentoo-dev 2004-06-22 13:53:23 UTC
No response from maintainer within the initial 48 hrs, so I'm adding what I have to portage as is. (pure-ftpd-1.0.18-r1.ebuild)
KEYWORDS="~x86 ~ppc ~sparc ~alpha ~hppa ~amd64 ~ia64"

QA problems with ldap flag can be handled by another team.
Comment 4 Bryan Ƙstergaard (RETIRED) gentoo-dev 2004-06-23 13:43:41 UTC
Compiled fine on alpha with USE=ldap. Marked stable.
Comment 5 Jason Wever (RETIRED) gentoo-dev 2004-06-23 20:13:53 UTC
Stable on sparc cause we're cool like that :)
Comment 6 Thierry Carrez (RETIRED) gentoo-dev 2004-06-24 14:23:30 UTC
Missing x86, ppc, hppa, ia64 stable on 1.0.18-r1.
Removing amd64 as their stable is not needed on this one.
Comment 7 SpanKY gentoo-dev 2004-06-24 16:11:49 UTC
marked x86/hppa stable
Comment 8 Aron Griffis (RETIRED) gentoo-dev 2004-06-24 16:25:01 UTC
all set on ia64
Comment 9 Michael Hanselmann (hansmi) (RETIRED) gentoo-dev 2004-07-04 10:53:27 UTC
Stable on ppc.
Comment 10 Thierry Carrez (RETIRED) gentoo-dev 2004-07-04 12:47:33 UTC
GLSA 200407-04