Re: FWD: iDEFENSE Security Advisory 02.25.05: WU-FTPD File Globbing Denial of Service Vulnerability

I haven't had a chance to review this patch - and therefor, no chance test
it against the vulnerability published.  Has anyone else validated the
patch that Chris published?  And if so - is this a patch that we can
publish on the wu-ftpd site and notify the security lists that a viable
solution is available?

ted keller


On Mon, 28 Feb 2005, Bob Luckin wrote:

> Chris,
>
> Glad it was useful.  However, I don't have write access to the Web/FTP site, so
> someone else will have to upload the patch.  Kent ?  Koos ?
>
> Cheers, Bob
>
> On Sat, Feb 26, 2005 at 09:58:06AM +0000, Chris Butler wrote:
> > On Fri, Feb 25, 2005 at 04:28:39PM -0600, Bob Luckin wrote:
> > > I have an old development snapshot (which I downloaded in 2002 !) which
> > > contains the following comment near the start of the CHANGES file :-
> > >
> > >    Changes in 2.8.0: Released <not yet>
> > >
> > >     o  Fixed a problem which allowed file globs with series of stars to hang
> > >        the server.  In fixpath, reduce all series of stars to a single star.
> > >
> > > This might address the vulnerability discussed below, although I'm not sure.
> > > I suggest you pull the latest development snapshot and have a look to see if
> > > it really has fixed the problem.
> >
> > Thanks for letting me know about this! Saved me a lot of time, as well
> > as fixing the problem in a better way than I was going to.
> >
> > After copying the changes from the ftpglob function into the 2.6.2 code,
> > I can confirm that the attached patch fixes the DoS vulnerability. It
> > should probably be announced properly on the website if that's possible.
> >
> > --
> > Chris Butler    <[email protected]>
> >  Debian WU-FTPD package maintainer
> >    GnuPG Key ID: 1024D/D097A261
>
> > Index: ftpd.c
> > ===================================================================
> > --- ftpd.c	(revision 39)
> > +++ ftpd.c	(working copy)
> > @@ -7510,6 +7510,8 @@
> >  	    in++;
> >  	    if (*in == '/')
> >  		in++;
> > +	    else
> > +		out++;
> >  	}
> >  	else if ((in[0] == '.') && (in[1] == '.') && ((in[2] == '/') || (in[2] == '\0'))) {
> >  	    if (out == path) {
> > @@ -7538,6 +7540,9 @@
> >  	}
> >  	else {
> >  	    do
> > +              if ((in[0] == '*') && (in[1] == '*'))
> > +                in++;
> > +              else
> >  		*out++ = *in++;
> >  	    while ((*in != '\0') && (*in != '/'));
> >  	    if (*in == '/')
>
>
> --
> Bob Luckin      [email protected]      "Coder, adapt; FTP Ada, redo C"
>