|Summary:||net-ftp/pure-ftpd-1.0.19 fixes DoS when max connections is reached|
|Product:||Gentoo Security||Reporter:||Jeremy Kitchen <jeremy>|
|Component:||Vulnerabilities||Assignee:||Gentoo Security <security>|
|Severity:||minor||CC:||chriswhite, grandmasterlinux, ppc|
|Package list:||Runtime testing required:||---|
Description Jeremy Kitchen 2004-06-20 20:46:34 UTC
as shown in the following two emails to the pure-ftpd mailing list (firstname.lastname@example.org), there is a denial of service attack possible against pureftpd. http://scriptkitchen.com/pureftpd/pure-ml1.txt http://scriptkitchen.com/pureftpd/pure-ml2.txt (Sorry, I don't know of any mailing list archives that have this, these are from my server) Fix: upgrade to 1.0.19. I'd submit a patch, but there were quite a few changes between the two versions, and I'm not sure which one(s) is(are) applicable. I don't think this happens in inetd mode (not confirmed), but since gentoo's pure-ftpd uses daemon mode, it applies here. Not sure if this is the entire thing, but assuming based on what the ChangeLog says, this is a patch that should encompass the change (for backporting purposes, etc) http://scriptkitchen.com/pureftpd/pure-ftpd-glsa.patch I applied it against my pure-ftpd 1.0.18 source with patch -p1, and it built properly and was functional. Reproducible: Always Steps to Reproduce:
Comment 1 Jeremy Kitchen 2004-06-20 20:54:06 UTC
err... duh. Sorry, I switched gears mid-post and decided to submit a patch, but didn't change the "I'd submit a patch" part. my bad :)
Comment 2 solar (RETIRED) 2004-06-20 21:26:04 UTC
raker, I could not get this one to bump local with the USE=ldap flag or apply the patch. Not sure if others are having (will have) that problem or not.
Comment 3 solar (RETIRED) 2004-06-22 13:53:23 UTC
No response from maintainer within the initial 48 hrs, so I'm adding what I have to portage as is. (pure-ftpd-1.0.18-r1.ebuild) KEYWORDS="~x86 ~ppc ~sparc ~alpha ~hppa ~amd64 ~ia64" QA problems with ldap flag can be handled by another team.
Comment 4 Bryan Østergaard (RETIRED) 2004-06-23 13:43:41 UTC
Compiled fine on alpha with USE=ldap. Marked stable.
Comment 5 Jason Wever (RETIRED) 2004-06-23 20:13:53 UTC
Stable on sparc cause we're cool like that :)
Comment 6 Thierry Carrez (RETIRED) 2004-06-24 14:23:30 UTC
Missing x86, ppc, hppa, ia64 stable on 1.0.18-r1. Removing amd64 as their stable is not needed on this one.
Comment 7 SpanKY 2004-06-24 16:11:49 UTC
marked x86/hppa stable
Comment 8 Aron Griffis (RETIRED) 2004-06-24 16:25:01 UTC
all set on ia64
Comment 9 Michael Hanselmann (hansmi) (RETIRED) 2004-07-04 10:53:27 UTC
Stable on ppc.
Comment 10 Thierry Carrez (RETIRED) 2004-07-04 12:47:33 UTC