REDHAT-BUG-397011

First published: Fri Nov 23 2007(Updated: )

Description of problem: There is a memory leak that causes memory to be allocated but not freed. When the deny_file option is set, it is possible to easily exploit this. This is a regression caused by applied patch in <a class="bz_bug_link bz_status_CLOSED bz_closed bz_public " title="CLOSED RAWHIDE - deny_file seems to not work" href="show_bug.cgi?id=174764">bz174764</a>. Problem also exists in FC-6, F-7, F-8 and fedora/devel. Attached is a patch to solve the problem. Version-Release number of selected component (if applicable): vsftpd-2.0.5-10.el5 How reproducible: always Steps to Reproduce: # echo deny_file=foo &gt;&gt; /etc/vsftpd/vsftpd.conf # service vsftpd restart $ cat &gt; memtest.sh &lt;&lt; EOF #!/bin/bash echo USER anonymous echo PASS foo while [ 1 ]; do echo CWD pub echo CWD .. done EOF $ chmod 700 memtest.sh $ ./memtest.sh | telnet localhost 21 &gt; /dev/null Actual results: vsftpd starts to allocate memory that will never be freed. Expected results: Additional info: It is possible that the memory leak can be exploited by other means, or with other vsftpd.conf options. This was not investigated into more depth.

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• collector/redhat-bugzilla
• alias/CVE-2007-5962
• agent/first-publish-date
• agent/last-modified-date
• agent/type
• agent/references
• agent/description
• agent/severity
• agent/softwarecombine
• agent/event
• agent/tags
• agent/guess-ai
• agent/software-canonical-lookup
• agent/software-canonical-lookup-request
• vendor/vsftpd
• canonical/vsftpd
• vendor/fedora
• canonical/fedora