Re: DoS in debian (potato) proftpd

From: martin f krafft (madduck@madduck.net)
Date: 03/27/02 

Date: Wed, 27 Mar 2002 00:37:59 +0100
From: martin f krafft <madduck@madduck.net>
To: bugtraq@securityfocus.com

also sprach Joe Dollard <joed@devel.livenote.com> [2002.03.25.2114 +0100]:
> The version of proftp that is in debian potato (1.2.0pre10 as
> reported by running 'proftpd -v ') is vulnerable to a glob DoS
> attack, as discovered on the 15th March 2001. You can verify this
> bug by logging in to a server running debian stable's proftpd and
> type "ls
> */../*/../*/../*/../*/../*/../*/../*/../*/../*/../*/../*/../*".
> This results with 100% of the CPU and memory resources being
> consumed (more info at http://proftpd.linux.co.uk/critbugs.html),

(please fix your line wraps!)

security.debian.org has proftpd_1.2.0pre10-2.0potato1 which does not
contain this bug, at least not on i386 systems:

fishbowl:~> ncftp lapse.home.madduck.net
NcFTP 3.1.2 (Jan 28, 2002) by Mike Gleason (ncftp@ncftp.com).
Connecting to 192.168.14.3
ProFTPD 1.2.0pre10 Server (Debian) [lapse.home.madduck.net]
Logging in...

Anonymous access granted, restrictions apply.
Logged in to localhost.
ncftp / > ls */../*/../*/../*/../*/../*/../*/../*/../*/../*/../*/../*/../*
lics/../lics/../lics/../lics/../lics/../lics/../lics/../lics/../lics/../lics/../lics/../lics/.././fw1-4.1-sp3@
lics/../lics/../lics/../lics/../lics/../lics/../lics/../lics/../lics/../lics/../lics/../lics/../../fw1-4.1-sp3@
lics/../lics/../lics/../lics/../lics/../lics/../lics/../lics/../lics/../lics/../lics/../lics/../fw1-4.1-sp3@
lics/../lics/../lics/../lics/../lics/../lics/../lics/../lics/../lics/../lics/../lics/../lics/.././fw1-4.1-sp4@
lics/../lics/../lics/../lics/../lics/../lics/../lics/../lics/../lics/../lics/../lics/../lics/../../fw1-4.1-sp4@
lics/../lics/../lics/../lics/../lics/../lics/../lics/../lics/../lics/../lics/../lics/../lics/../fw1-4.1-sp4@
lics/../lics/../lics/../lics/../lics/../lics/../lics/../lics/../lics/../lics/../lics/../lics/.././fw1-4.1-sp5@
lics/../lics/../lics/../lics/../lics/../lics/../lics/../lics/../lics/../lics/../lics/../lics/../../fw1-4.1-sp5@
lics/../lics/../lics/../lics/../lics/../lics/../lics/../lics/../lics/../lics/../lics/../lics/../fw1-4.1-sp5@

<and on for another screen full>

fishbowl:~> ssh lapse 'cat /etc/debian_version; uname -a'
2.2r5
Linux lapse 2.2.20 #1 Tue Feb 12 14:22:30 CET 2002 i486

regards, 

-- 
martin;              (greetings from the heart of the sun.)
  \____ echo mailto: !#^."<*>"|tr "<*> mailto:" net@madduck
 
"i'm always frank and earnest with women.
 uh, in new york i'm frank, and in chicago i'm ernest."
                                            -- the long kiss goodnight

Relevant Pages

  • Re: FTPS rc = 406 (Error while reading or writing data)
    ... explicit FTPS on port 990 rather than implicit which is what you would ... normally expect on that port. ... Frank Finley, CISSP ... side) client connecting to a Unix FTPS server running proftpd. ...
    (bit.listserv.ibm-main)
  • Re: SP2 - Do I need it?
    ... > For your peace of mind, I have no intention of connecting my ... > home pc to any other computer, via the internet or otherwise. ... Please note I cannot respond to e-mailed questions, please use these newsgroups "Frank" wrote in message ... In other words if it was always going to be a>>> standalone computer performing a set group of tasks and was doing those ...
    (microsoft.public.windowsxp.general)
  • Re: Access 2003 - ODBC File Data Source - Relink every Access Sess
    ... Frank you rock! ... >> I open Access Project, I double click on a table to open it, dialog box ... > Click on the Link Tables option and select your ODBC data source as usual. ...
    (microsoft.public.data.odbc)
  • Re: XP Terminal Service - Local Policy does not permit ...
    ... Frank, internal by machine name. ... connect to the 2 upgraded from 2K Pro to XP Pro. ... >> Are you connecting from inside the LAN or by Internet? ...
    (microsoft.public.windows.server.sbs)
  • Re: XP Terminal Service - Local Policy does not permit ...
    ... Try connecting by IP and see if that works. ... "KevinK" wrote in message ... > Frank, internal by machine name. ... > Randy, yes I connected that as the common thread ...
    (microsoft.public.windows.server.sbs)