Date: Mon, 30 Jun 2008 09:45:05 +0100 (BST) From: Mark J Cox <mjc@...hat.com> To: oss-security@...ts.openwall.com Subject: CVE-2008-2375 older vsftpd authentication memory leak Customers reported that the pre 2.0.5 versions of vsftpd as shipped in Red Hat Enterprise Linux 3 and 4 when used in combination with PAM had a memory leak on an invalid authentication attempt. Since upstream vsftpd prior to 2.0.5 allows any number of invalid attempts on the same connection this memory leak could lead to an eventual DoS. I've allocated this CVE-2008-2375. Upstream vsftpd 2.0.5 changed its behaviour so that 3 (configurable) invalid password attempts would close the connection (hence allowing easier detection of brute forcing attacks etc), and this therefore also stops any memory leak from leading to a DoS. So we're going to add this backported patch to our older vsftpd versions: https://bugzilla.redhat.com/attachment.cgi?id=201051 No embargo on this, the CVE only applies to other distros that are supporting vsftpd < 2.0.5 and have a memory leak. We also didn't yet chase down the root cause of the leak since it's mitigated by the patch. Thanks, Mark -- Mark J Cox / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.