Ubuntu
wzdftpd package

CVE-2007-5300 remote denial of service

Bug #151946 reported by Stephan Rügamer
254
Affects Status Importance Assigned to Milestone
wzdftpd (Debian)
Fix Released
Unknown
wzdftpd (Ubuntu)
Fix Released
Medium
Unassigned
Dapper
Fix Released
Undecided
Stephan Rügamer
Edgy
Fix Released
Undecided
Stephan Rügamer
Feisty
Fix Released
Undecided
Stephan Rügamer
Gutsy
Fix Released
Medium
Unassigned

Bug Description

Binary package hint: wzdftpd

From The debian bug report (http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=446192):
Hi,
the following CVE (Common Vulnerabilities & Exposures) id was
published for wzdftpd.

CVE-2007-5300[0]:
| Off-by-one error in the do_login_loop function in
| libwzd-core/wzd_login.c in wzdftpd 0.8.2 and earlier allows remote
| attackers to cause a denial of service (daemon crash) via a long USER
| command that triggers a stack-based buffer overflow. NOTE: some of
| these details are obtained from third party information.

If you fix this vulnerability please also include the CVE id
in your changelog entry.

For further information:
[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5300

Kind regards
Nico

CVE References

Revision history for this message
Stephan Rügamer (sruegamer) wrote :

I'll add some debdiffs for all supported releases.
Gutsy first, because it's 5 to 12pm ;)

Revision history for this message
Stephan Rügamer (sruegamer) wrote :
Philipp Kern (pkern)
Changed in wzdftpd:
status: New → Fix Committed
importance: Undecided → Medium
Revision history for this message
Stephan Rügamer (sruegamer) wrote :

This debdiff will fix

CVE-2007-0428
(under review)

Learn more at National Vulnerability Database (NVD)
• Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings
Description
Unspecified vulnerability in the chtbl_lookup function in hash.c for WzdFTPD 8.0 and earlier allows remote attackers to cause a denial of service via a crafted FTP command, probably due to a NULL pointer dereference.

as well

Revision history for this message
Stephan Rügamer (sruegamer) wrote :

this debdiff will fix

CVE-2007-0428
(under review)

Learn more at National Vulnerability Database (NVD)
• Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings
Description
Unspecified vulnerability in the chtbl_lookup function in hash.c for WzdFTPD 8.0 and earlier allows remote attackers to cause a denial of service via a crafted FTP command, probably due to a NULL pointer dereference.

as well

Revision history for this message
Stephan Rügamer (sruegamer) wrote :

This debdiff will fix

CVE-2007-0428
(under review)

Learn more at National Vulnerability Database (NVD)
• Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings
Description
Unspecified vulnerability in the chtbl_lookup function in hash.c for WzdFTPD 8.0 and earlier allows remote attackers to cause a denial of service via a crafted FTP command, probably due to a NULL pointer dereference.

as well

Revision history for this message
Kees Cook (kees) wrote :

Hi! Thanks for getting these prepared. It seems that this package uses dpatch for patches. Your feisty diff includes both in and out of dpatch patches, and dapper and edgy lack dpatch at all. (Also, the gutsy/feisty fixes for wzd_protocol.c, are these accidentally missing in edgy/dapper?)

Thanks!

Changed in wzdftpd:
assignee: nobody → shermann
status: New → In Progress
assignee: nobody → shermann
status: New → In Progress
assignee: nobody → shermann
status: New → In Progress
Bug Watch Updater (bug-watch-updater)
Changed in wzdftpd:
status: Unknown → Fix Released
Revision history for this message
Stephan Rügamer (sruegamer) wrote :

Hi Kees,

damn...I knew I made a mistake with the feisty stuff...let me fix it.
Dapper and Edgy do have dpatch as build-dep but don't use it anywhere.
Feisty and Gutsy are using dpatch for sure.

libwzd-core/wzd_protocol.c is not in the versions of dapper and edgy.
The fixed part in dapper and edgy are libwzd-core/wzd_ClientThread.c

So, the only thing still left is feisty...

Should I remove the dpatch from build-deps in dapper and edgy?

Regards,

\sh

Revision history for this message
Stephan Rügamer (sruegamer) wrote :

wzdftpd (0.8.2-2ubuntu2) gutsy; urgency=high

  * debian/patches/90_CVE-2007-5300_off_by_one_fix.dpatch:
    Fix off-by-one in wzd_login.c which leads to a remote
    denial of service vulnerability (CVE-2007-5300) (LP: #151946)
    (Fix provided by Nico Golde <email address hidden>)

 -- Stephan Hermann <email address hidden> Fri, 12 Oct 2007 13:56:32 +0200

Changed in wzdftpd:
status: Fix Committed → Fix Released
Revision history for this message
Stephan Rügamer (sruegamer) wrote :

hi Kees,

this is the fixed debdiff for feisty

Thx for your work :)

\sh

Revision history for this message
Kees Cook (kees) wrote : Re: [Bug 151946] Re: CVE-2007-5300 remote denial of service

> damn...I knew I made a mistake with the feisty stuff...let me fix it.
> Dapper and Edgy do have dpatch as build-dep but don't use it anywhere.

I think it works -- they just have no debian/patches directory. It
looks like the debian/rules file uses it correctly ("patch", "unpatch"
are called). Go ahead and add the directory and the patch there.
That'll make a clean update for future fixes too.

> Feisty and Gutsy are using dpatch for sure.
>
> libwzd-core/wzd_protocol.c is not in the versions of dapper and edgy.
> The fixed part in dapper and edgy are libwzd-core/wzd_ClientThread.c

Ah-ha, that explains it. :)

> Should I remove the dpatch from build-deps in dapper and edgy?

No, dpatch is required for the build; dapper and edgy just happen to not
have any patches (yet).

Thanks!

Revision history for this message
Stephan Rügamer (sruegamer) wrote :

hi Kees,

could it be that you accidently forgot to upload dapper, edgy and feisty after I fixed feisty?
dapper and edgy are still functional...

Regards,

\sh

Revision history for this message
Kees Cook (kees) wrote :

Sorry for the delay. These have been uploaded to the security queue and should be published shortly.

Changed in wzdftpd:
status: In Progress → Fix Committed
status: In Progress → Fix Committed
status: In Progress → Fix Committed
Kees Cook (kees)
Changed in wzdftpd:
status: Fix Committed → Fix Released
status: Fix Committed → Fix Released
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public Security information  
Everyone can see this security related information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.