CVE-2007-5962: High severity redhat Enterprise Linux vulnerability
Description of problem: There is a memory leak that causes memory to be allocated but not freed. When the denyfile option is set, it is possible to easily exploit this. This is a regression caused by applied patch in bz174764. Problem also exists in FC-6, F-7, F-8 and fedora/devel. Attached is a patch to solve the problem.
Version-Release number of selected component (if applicable): vsftpd-2.0.5-10.el5
How reproducible: always
Steps to Reproduce: echo denyfile=foo >> /etc/vsftpd/vsftpd.conf service vsftpd restart
$ cat > memtest.sh << EOF #!/bin/bash echo USER anonymous echo PASS foo
while [ 1 ]; do echo CWD pub echo CWD .. done EOF
$ chmod 700 memtest.sh $ ./memtest.sh | telnet localhost 21 > /dev/null
Actual results: vsftpd starts to allocate memory that will never be freed.
Expected results:
Additional info: It is possible that the memory leak can be exploited by other means, or with other vsftpd.conf options. This was not investigated into more depth.
Other sources
Memory leak in a certain Red Hat patch, applied to vsftpd 2.0.5 on Red Hat Enterprise Linux (RHEL) 5 and Fedora 6 through 8, and on Foresight Linux and rPath appliances, allows remote attackers to cause a denial of service (memory consumption) via a large number of CWD commands, as demonstrated by an attack on a daemon with the denyfile configuration option.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2007-5962?
CVE-2007-5962 is considered a medium severity vulnerability due to its potential for exploitation through a memory leak.
How do I fix CVE-2007-5962?
To fix CVE-2007-5962, ensure you update to the latest version of the affected software that addresses the memory leak.
Which software is affected by CVE-2007-5962?
CVE-2007-5962 affects Red Hat Enterprise Linux 5.0, Fedora versions 6 to 8, Foresight Linux, and rPath Appliance Platform Agent.
Can CVE-2007-5962 be exploited easily?
Yes, CVE-2007-5962 can be easily exploited when the deny_file option is set, leading to potential memory issues.
What are the potential consequences of CVE-2007-5962?
The consequences of CVE-2007-5962 include increased memory usage and potential application crashes due to the memory leak.