Description of problem: There is a memory leak that causes memory to be allocated but not freed. When the denyfile option is set, it is possible to easily exploit this. This is a regression caused by applied patch in bz174764. Problem also exists in FC-6, F-7, F-8 and fedora/devel. Attached is a patch to solve the problem.

Version-Release number of selected component (if applicable): vsftpd-2.0.5-10.el5

How reproducible: always

Steps to Reproduce: echo denyfile=foo >> /etc/vsftpd/vsftpd.conf service vsftpd restart

$ cat > memtest.sh << EOF #!/bin/bash echo USER anonymous echo PASS foo

while [ 1 ]; do echo CWD pub echo CWD .. done EOF

$ chmod 700 memtest.sh $ ./memtest.sh | telnet localhost 21 > /dev/null

Actual results: vsftpd starts to allocate memory that will never be freed.

Expected results:

Additional info: It is possible that the memory leak can be exploited by other means, or with other vsftpd.conf options. This was not investigated into more depth.

The sandbox for vim allows dangerous functions such as (1) writefile, (2) feedkeys, and (3) system, which might allow user-assisted attackers to execute shell commands and write files via modelines.