glsa-200409-27.xml


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">

<glsa id="200409-27">
  <title>glFTPd: Local buffer overflow vulnerability</title>
  <synopsis>
    glFTPd is vulnerable to a local buffer overflow which may allow arbitrary
    code execution.
  </synopsis>
  <product type="ebuild">glftpd</product>
  <announced>September 21, 2004</announced>
  <revised>September 21, 2004: 01</revised>
  <bug>64809</bug>
  <access>local</access>
  <affected>
    <package name="net-ftp/glftpd" auto="yes" arch="*">
      <unaffected range="ge">1.32-r1</unaffected>
      <vulnerable range="lt">1.32-r1</vulnerable>
    </package>
  </affected>
  <background>
    <p>
    glFTPd is a highly configurable FTP server with many features.
    </p>
  </background>
  <description>
    <p>
    The glFTPd server is vulnerable to a buffer overflow in the 'dupescan'
    program. This vulnerability is due to an unsafe strcpy() call which can
    cause the program to crash when a large argument is passed.
    </p>
  </description>
  <impact type="normal">
    <p>
    A local user with malicious intent can pass a parameter to the dupescan
    program that exceeds the size of the buffer, causing it to overflow. This
    can lead the program to crash, and potentially allow arbitrary code
    execution with the permissions of the user running glFTPd, which could be
    the root user.
    </p>
  </impact>
  <workaround>
    <p>
    There is no known workaround at this time.
    </p>
  </workaround>
  <resolution>
    <p>
    All glFTPd users should upgrade to the latest version:
    </p>
    <code>
    # emerge sync

    # emerge -pv ">=net-ftp/glftpd-1.32-r1"
    # emerge ">=net-ftp/glftpd-1.32-r1"</code>
  </resolution>
  <references>
    <uri link="http://www.securityfocus.com/archive/1/375775/2004-09-17/2004-09-23/0">BugTraq Advisory</uri>
    <uri link="http://www.glftpd.com/modules.php?op=modload&amp;name=News&amp;file=article&amp;sid=23&amp;mode=thread&amp;order=0&amp;thold=0">glFTPd Announcement</uri>
  </references>
  <metadata tag="submitter" timestamp="Tue, 21 Sep 2004 03:12:24 +0000">
    lewk
  </metadata>
  <metadata tag="bugReady" timestamp="Tue, 21 Sep 2004 03:12:31 +0000">
    lewk
  </metadata>
</glsa>