Re: FWD: iDEFENSE Security Advisory 02.25.05: WU-FTPD File Globbing Denial of Service Vulnerability

Chris,

Glad it was useful.  However, I don't have write access to the Web/FTP site, so
someone else will have to upload the patch.  Kent ?  Koos ?

Cheers, Bob

On Sat, Feb 26, 2005 at 09:58:06AM +0000, Chris Butler wrote:
> On Fri, Feb 25, 2005 at 04:28:39PM -0600, Bob Luckin wrote:
> > I have an old development snapshot (which I downloaded in 2002 !) which
> > contains the following comment near the start of the CHANGES file :-
> > 
> >    Changes in 2.8.0: Released <not yet>
> > 
> >     o  Fixed a problem which allowed file globs with series of stars to hang
> >        the server.  In fixpath, reduce all series of stars to a single star.
> > 
> > This might address the vulnerability discussed below, although I'm not sure.
> > I suggest you pull the latest development snapshot and have a look to see if
> > it really has fixed the problem.
> 
> Thanks for letting me know about this! Saved me a lot of time, as well
> as fixing the problem in a better way than I was going to. 
> 
> After copying the changes from the ftpglob function into the 2.6.2 code, 
> I can confirm that the attached patch fixes the DoS vulnerability. It
> should probably be announced properly on the website if that's possible.
> 
> -- 
> Chris Butler    <[email protected]>
>  Debian WU-FTPD package maintainer
>    GnuPG Key ID: 1024D/D097A261

> Index: ftpd.c
> ===================================================================
> --- ftpd.c	(revision 39)
> +++ ftpd.c	(working copy)
> @@ -7510,6 +7510,8 @@
>  	    in++;
>  	    if (*in == '/')
>  		in++;
> +	    else
> +		out++;
>  	}
>  	else if ((in[0] == '.') && (in[1] == '.') && ((in[2] == '/') || (in[2] == '\0'))) {
>  	    if (out == path) {
> @@ -7538,6 +7540,9 @@
>  	}
>  	else {
>  	    do
> +              if ((in[0] == '*') && (in[1] == '*'))
> +                in++;
> +              else
>  		*out++ = *in++;
>  	    while ((*in != '\0') && (*in != '/'));
>  	    if (*in == '/')


-- 
Bob Luckin      [email protected]      "Coder, adapt; FTP Ada, redo C"