A security flaw has been discovered in D-Link DIR-823G 1.0.2B05. The affected element is an unknown function of the file /etc/vsftpd.conf of the component vsftpd. Performing a manipulation results in least privilege violation. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.

A flaw was found in vsftpd. This vulnerability allows a denial of service (DoS) via an integer overflow in the ls command parameter parsing, triggered by a remote, authenticated attacker sending a crafted STAT command with a specific byte sequence.

Description of problem: There is a memory leak that causes memory to be allocated but not freed. When the denyfile option is set, it is possible to easily exploit this. This is a regression caused by applied patch in bz174764. Problem also exists in FC-6, F-7, F-8 and fedora/devel. Attached is a patch to solve the problem.

Version-Release number of selected component (if applicable): vsftpd-2.0.5-10.el5

How reproducible: always

Steps to Reproduce: echo denyfile=foo >> /etc/vsftpd/vsftpd.conf service vsftpd restart

$ cat > memtest.sh << EOF #!/bin/bash echo USER anonymous echo PASS foo

while [ 1 ]; do echo CWD pub echo CWD .. done EOF

$ chmod 700 memtest.sh $ ./memtest.sh | telnet localhost 21 > /dev/null

Actual results: vsftpd starts to allocate memory that will never be freed.

Expected results:

Additional info: It is possible that the memory leak can be exploited by other means, or with other vsftpd.conf options. This was not investigated into more depth.