oss-security - CVE-2008-2375 older vsftpd authentication memory leak

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / news community lists wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [month] [year] [list]

Date: Mon, 30 Jun 2008 09:45:05 +0100 (BST)
From: Mark J Cox <mjc@...hat.com>
To: oss-security@...ts.openwall.com
Subject: CVE-2008-2375 older vsftpd authentication memory leak

Customers reported that the pre 2.0.5 versions of vsftpd as shipped in Red 
Hat Enterprise Linux 3 and 4 when used in combination with PAM had a 
memory leak on an invalid authentication attempt.  Since upstream vsftpd 
prior to 2.0.5 allows any number of invalid attempts on the same 
connection this memory leak could lead to an eventual DoS.  I've allocated 
this CVE-2008-2375.

Upstream vsftpd 2.0.5 changed its behaviour so that 3 (configurable) 
invalid password attempts would close the connection (hence allowing 
easier detection of brute forcing attacks etc), and this therefore also 
stops any memory leak from leading to a DoS.  So we're going to add this 
backported patch to our older vsftpd versions:
https://bugzilla.redhat.com/attachment.cgi?id=201051

No embargo on this, the CVE only applies to other distros that are 
supporting vsftpd < 2.0.5 and have a memory leak.  We also didn't yet 
chase down the root cause of the leak since it's mitigated by the patch.

Thanks, Mark
--
Mark J Cox / Red Hat Security Response Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.