vsftpd vulnerable to heartbleed (according to testssl)

Bug #1591552 reported by AlainKnaff
258
This bug affects 1 person
Affects Status Importance Assigned to Milestone
vsftpd (Ubuntu)
Incomplete
Undecided
Unassigned

Bug Description

According to testssl (from https://testssl.sh/testssl.sh) vsftpd is vulnerable to heartbleed, with now obvious way (in the config) to secure it:

testssl@will:~$ ./testssl.sh -t ftp lll.lu:21
...
 Heartbleed (CVE-2014-0160) VULNERABLE (NOT ok)

Or is this a shortcoming of the testssl script, which reports a vulnerability where there is none? If this is the case, could anybody explain how the error happens, so that we can get testssl fixed?

1) root@lll:~# lsb_release -rd
Description: Ubuntu 14.04.4 LTS
Release: 14.04
2) root@lll:~# apt-cache policy vsftpd
vsftpd:
  Installed: 3.0.2-1ubuntu2.14.04.1
  Candidate: 3.0.2-1ubuntu2.14.04.1
  Version table:
 *** 3.0.2-1ubuntu2.14.04.1 0
        500 http://be.archive.ubuntu.com/ubuntu/ trusty-updates/main amd64 Packages
        100 /var/lib/dpkg/status
     3.0.2-1ubuntu2 0
        500 http://be.archive.ubuntu.com/ubuntu/ trusty/main amd64 Packages

3) What I expected to happen
 Heartbleed (CVE-2014-0160) not vulnerable (OK) (timed out)

4) What did happen
 Heartbleed (CVE-2014-0160) VULNERABLE (NOT ok)

Robie Basak (racb)
information type: Public → Public Security
Revision history for this message
Joshua Powers (powersj) wrote :

There appears to be a bug report around a false positive with testssl.sh [1] and fix [2] specific to vsftpd. This was reported after this bug report, so I am wondering if you could retest. For now I am marking this as 'incomplete', if you get newer results please mark this as 'new'.

I would also be curious to see your vsftpd.conf file to know how you are configuring it.

[1] https://github.com/drwetter/testssl.sh/issues/426
[2] https://github.com/drwetter/testssl.sh/commit/d1cc7b3755478f302a5f957e2bbcaf17899951fc

Changed in vsftpd (Ubuntu):
status: New → Incomplete
Revision history for this message
AlainKnaff (kubuntu-misc) wrote :

I just re-downloaded the current version of testssl.sh (dated December 20th 2016), and tried again, and vsftpd is still shown to be vulnerable to Heartbleed.

Revision history for this message
Joshua Powers (powersj) wrote :

Thanks for the response. Any chance I could see your vsftpd.conf file and know what versions of openssl and libssl1.0.0 are installed? I ask because I was unable to reproduce.

I've pasted the results of my testssl.sh [1] and vsftpd.conf [2], and the versions of vsftpd, openssl, and libssl1.0.0 [3].

[1] https://paste.ubuntu.com/23863796/
[2] https://paste.ubuntu.com/23863798/
[3] https://paste.ubuntu.com/23863808/

Revision history for this message
AlainKnaff (kubuntu-misc) wrote :
Download full text (7.1 KiB)

> Any chance I could see your vsftpd.conf file

Sure, here it is:

# Example config file /etc/vsftpd.conf
#
# The default compiled in settings are fairly paranoid. This sample file
# loosens things up a bit, to make the ftp daemon more usable.
# Please see vsftpd.conf.5 for all compiled in defaults.
#
# READ THIS: This example file is NOT an exhaustive list of vsftpd options.
# Please read the vsftpd.conf.5 manual page to get a full idea of vsftpd's
# capabilities.
#
#
# Run standalone? vsftpd can run either from an inetd or as a standalone
# daemon started from an initscript.
listen=YES
#
# Run standalone with IPv6?
# Like the listen parameter, except vsftpd will listen on an IPv6 socket
# instead of an IPv4 one. This parameter and the listen parameter are mutually
# exclusive.
#listen_ipv6=YES
#
# Allow anonymous FTP? (Disabled by default)
anonymous_enable=YES
#
# Uncomment this to allow local users to log in.
local_enable=YES
#
# Uncomment this to enable any form of FTP write command.
write_enable=YES
#
# Default umask for local users is 077. You may wish to change this to 022,
# if your users expect that (022 is used by most other ftpd's)
local_umask=022
#
# Uncomment this to allow the anonymous FTP user to upload files. This only
# has an effect if the above global write enable is activated. Also, you will
# obviously need to create a directory writable by the FTP user.
#anon_upload_enable=YES
#
# Uncomment this if you want the anonymous FTP user to be able to create
# new directories.
#anon_mkdir_write_enable=YES
#
# Activate directory messages - messages given to remote users when they
# go into a certain directory.
dirmessage_enable=YES
#
# If enabled, vsftpd will display directory listings with the time
# in your local time zone. The default is to display GMT. The
# times returned by the MDTM FTP command are also affected by this
# option.
use_localtime=YES
#
# Activate logging of uploads/downloads.
xferlog_enable=YES
#
# Make sure PORT transfer connections originate from port 20 (ftp-data).
connect_from_port_20=YES
#
# If you want, you can arrange for uploaded anonymous files to be owned by
# a different user. Note! Using "root" for uploaded files is not
# recommended!
#chown_uploads=YES
#chown_username=whoever
#
# You may override where the log file goes if you like. The default is shown
# below.
#xferlog_file=/var/log/vsftpd.log
#
# If you want, you can have your log file in standard ftpd xferlog format.
# Note that the default log file location is /var/log/xferlog in this case.
#xferlog_std_format=YES
#
# You may change the default value for timing out an idle session.
#idle_session_timeout=600
#
# You may change the default value for timing out a data connection.
#data_connection_timeout=120
#
# It is recommended that you define on your system a unique user which the
# ftp server can use as a totally isolated and unprivileged user.
#nopriv_user=ftpsecure
#
# Enable this and the server will recognise asynchronous ABOR requests. Not
# recommended for security (the code is non-trivial). Not enabling it,
# however, may confuse older FTP clients.
#async_abor_enable=YES
#
# By default the server will pretend to allow ASCII mode ...

Read more...

Revision history for this message
Joshua Powers (powersj) wrote :

Hmm I'm still not getting a reproducer [1]. Are you sure you have restarted your ftp server since you have updated openssl? I am sure you have, but that is the only thing I can think of.

I took your config and just changed the certificates to use mine.

[1] https://paste.ubuntu.com/23865421/

To post a comment you must log in.
This report contains Public Security information  
Everyone can see this security related information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.