NetBSD Problem Report #43023

From www@NetBSD.org  Sat Mar 20 15:11:30 2010
Return-Path: <www@NetBSD.org>
Received: from mail.netbsd.org (mail.netbsd.org [204.152.190.11])
	by www.NetBSD.org (Postfix) with ESMTP id 3D92963B86C
	for <gnats-bugs@gnats.NetBSD.org>; Sat, 20 Mar 2010 15:11:30 +0000 (UTC)
Message-Id: <20100320151129.D908063B11D@www.NetBSD.org>
Date: Sat, 20 Mar 2010 15:11:29 +0000 (UTC)
From: bruce@cran.org.uk
Reply-To: bruce@cran.org.uk
To: gnats-bugs@NetBSD.org
Subject: FTPD bug remote crash
X-Send-Pr-Version: www-1.0

>Number:         43023
>Category:       bin
>Synopsis:       FTPD bug remote crash
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    bin-bug-people
>State:          closed
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Mar 20 15:15:00 +0000 2010
>Closed-Date:    Sun Jun 13 20:02:21 +0000 2010
>Last-Modified:  Mon Mar 25 04:15:02 +0000 2013
>Originator:     Bruce Cran
>Release:        N/A
>Organization:
>Environment:
N/A
>Description:
Copied from http://www.freebsd.org/cgi/query-pr.cgi?pr=144761 :

FTPD child process can die with signal 11, bug found by Kingcope
 kernel: pid 46033 (ftpd), uid 1001: exited on signal 11
 References :
 http://seclists.org/fulldisclosure/2010/Mar/117
 http://seclists.org/fulldisclosure/2010/Mar/138
 http://seclists.org/fulldisclosure/2010/Mar/139
>How-To-Repeat:

>Fix:

>Release-Note:

>Audit-Trail:
From: Christos Zoulas <christos@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/43023 CVS commit: src/libexec/ftpd
Date: Sat, 20 Mar 2010 14:23:30 -0400

 Module Name:	src
 Committed By:	christos
 Date:		Sat Mar 20 18:23:30 UTC 2010

 Modified Files:
 	src/libexec/ftpd: popen.c

 Log Message:
 PR/43023: Bruce Cran: FTPD bug remote crash
 Since we specify NOCHECK, in the NOMATCH case gl_pathv can be NULL.
 (From FreeBSD)


 To generate a diff of this commit:
 cvs rdiff -u -r1.36 -r1.37 src/libexec/ftpd/popen.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: Luke Mewburn <lukem@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/43023 CVS commit: othersrc/libexec/tnftpd/src
Date: Sun, 21 Mar 2010 11:07:37 +0000

 Module Name:	othersrc
 Committed By:	lukem
 Date:		Sun Mar 21 11:07:37 UTC 2010

 Modified Files:
 	othersrc/libexec/tnftpd/src: popen.c

 Log Message:
 Apply rev 1.37 from NetBSD:
  PR/43023: Bruce Cran: FTPD bug remote crash
  Since we specify NOCHECK, in the NOMATCH case gl_pathv can be NULL.
  (From FreeBSD)


 To generate a diff of this commit:
 cvs rdiff -u -r1.15 -r1.16 othersrc/libexec/tnftpd/src/popen.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: Luke Mewburn <lukem@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/43023 CVS commit: src/libexec/ftpd
Date: Sun, 21 Mar 2010 20:27:26 +0000

 Module Name:	src
 Committed By:	lukem
 Date:		Sun Mar 21 20:27:26 UTC 2010

 Modified Files:
 	src/libexec/ftpd: version.h

 Log Message:
 Update version to 20100320 for Christos' commit to popen.c 1.37 for:
  PR/43023: Bruce Cran: FTPD bug remote crash


 To generate a diff of this commit:
 cvs rdiff -u -r1.73 -r1.74 src/libexec/ftpd/version.h

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: Luke Mewburn <lukem@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/43023 CVS commit: othersrc/libexec/tnftpd
Date: Wed, 24 Mar 2010 12:31:39 +0000

 Module Name:	othersrc
 Committed By:	lukem
 Date:		Wed Mar 24 12:31:39 UTC 2010

 Modified Files:
 	othersrc/libexec/tnftpd: configure.ac

 Log Message:
 tnftpd 20100324:
 * Security fix when globbing paths.  NetBSD PR/43023.
 * Install example configuration files.


 To generate a diff of this commit:
 cvs rdiff -u -r1.28 -r1.29 othersrc/libexec/tnftpd/configure.ac

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: Soren Jacobsen <snj@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/43023 CVS commit: [netbsd-5] src/libexec/ftpd
Date: Mon, 12 Apr 2010 02:28:17 +0000

 Module Name:	src
 Committed By:	snj
 Date:		Mon Apr 12 02:28:16 UTC 2010

 Modified Files:
 	src/libexec/ftpd [netbsd-5]: popen.c

 Log Message:
 Pull up following revision(s) (requested by lukem in ticket #1372):
 	libexec/ftpd/popen.c: revision 1.37
 PR/43023: Bruce Cran: FTPD bug remote crash
 Since we specify NOCHECK, in the NOMATCH case gl_pathv can be NULL.
 (From FreeBSD)


 To generate a diff of this commit:
 cvs rdiff -u -r1.34 -r1.34.4.1 src/libexec/ftpd/popen.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: Soren Jacobsen <snj@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/43023 CVS commit: [netbsd-5] src/libexec/ftpd
Date: Mon, 12 Apr 2010 02:30:12 +0000

 Module Name:	src
 Committed By:	snj
 Date:		Mon Apr 12 02:30:12 UTC 2010

 Modified Files:
 	src/libexec/ftpd [netbsd-5]: version.h

 Log Message:
 Pull up following revision(s) (requested by lukem in ticket #1372):
 	libexec/ftpd/version.h: revision 1.74
 Update version to 20100320 for Christos' commit to popen.c 1.37 for:
  PR/43023: Bruce Cran: FTPD bug remote crash


 To generate a diff of this commit:
 cvs rdiff -u -r1.70 -r1.70.4.1 src/libexec/ftpd/version.h

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: Soren Jacobsen <snj@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/43023 CVS commit: [netbsd-5-0] src/libexec/ftpd
Date: Mon, 12 Apr 2010 02:33:59 +0000

 Module Name:	src
 Committed By:	snj
 Date:		Mon Apr 12 02:33:59 UTC 2010

 Modified Files:
 	src/libexec/ftpd [netbsd-5-0]: popen.c

 Log Message:
 Pull up following revision(s) (requested by lukem in ticket #1372):
 	libexec/ftpd/popen.c: revision 1.37
 PR/43023: Bruce Cran: FTPD bug remote crash
 Since we specify NOCHECK, in the NOMATCH case gl_pathv can be NULL.
 (From FreeBSD)


 To generate a diff of this commit:
 cvs rdiff -u -r1.34 -r1.34.8.1 src/libexec/ftpd/popen.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: Soren Jacobsen <snj@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/43023 CVS commit: [netbsd-5-0] src/libexec/ftpd
Date: Mon, 12 Apr 2010 02:35:02 +0000

 Module Name:	src
 Committed By:	snj
 Date:		Mon Apr 12 02:35:02 UTC 2010

 Modified Files:
 	src/libexec/ftpd [netbsd-5-0]: version.h

 Log Message:
 Pull up following revision(s) (requested by lukem in ticket #1372):
 	libexec/ftpd/version.h: revision 1.74
 Update version to 20100320 for Christos' commit to popen.c 1.37 for:
  PR/43023: Bruce Cran: FTPD bug remote crash


 To generate a diff of this commit:
 cvs rdiff -u -r1.70 -r1.70.8.1 src/libexec/ftpd/version.h

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

State-Changed-From-To: open->feedback
State-Changed-By: dholland@NetBSD.org
State-Changed-When: Tue, 20 Apr 2010 15:34:54 +0000
State-Changed-Why:
Is this completely fixed?


From: Bruce Cran <bruce@cran.org.uk>
To: gnats-bugs@netbsd.org
Cc: gnats-admin@netbsd.org,
 netbsd-bugs@netbsd.org,
 dholland@netbsd.org
Subject: Re: bin/43023 (FTPD bug remote crash)
Date: Thu, 20 May 2010 08:00:48 +0100

 On Tuesday 20 April 2010 16:34:55 dholland@netbsd.org wrote:

 > Is this completely fixed?

 I presume so: I only logged the PR when I saw a report of it elsewhere; I have 
 no way of testing whether it has been fixed.

 -- 
 Bruce Cran

State-Changed-From-To: feedback->closed
State-Changed-By: dholland@NetBSD.org
State-Changed-When: Sat, 29 May 2010 17:32:09 +0000
State-Changed-Why:
It looks to me at least like the fix has been propagated everywhere...


State-Changed-From-To: closed->pending-pullups
State-Changed-By: dholland@NetBSD.org
State-Changed-When: Sat, 29 May 2010 18:08:16 +0000
State-Changed-Why:
wrong, needs pullup-4 #1395, which I just filed


From: Jeff Rizzo <riz@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/43023 CVS commit: [netbsd-4] src/libexec/ftpd
Date: Sun, 13 Jun 2010 18:12:37 +0000

 Module Name:	src
 Committed By:	riz
 Date:		Sun Jun 13 18:12:37 UTC 2010

 Modified Files:
 	src/libexec/ftpd [netbsd-4]: popen.c

 Log Message:
 Pull up following revision(s) (requested by dholland in ticket #1395):
 	libexec/ftpd/popen.c: revision 1.37
 PR/43023: Bruce Cran: FTPD bug remote crash
 Since we specify NOCHECK, in the NOMATCH case gl_pathv can be NULL.
 (From FreeBSD)


 To generate a diff of this commit:
 cvs rdiff -u -r1.31 -r1.31.4.1 src/libexec/ftpd/popen.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

State-Changed-From-To: pending-pullups->closed
State-Changed-By: dholland@NetBSD.org
State-Changed-When: Sun, 13 Jun 2010 20:02:21 +0000
State-Changed-Why:
done, thanks


From: "Luke Mewburn" <lukem@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/43023 CVS commit: othersrc/libexec/tnftpd/src
Date: Thu, 21 Mar 2013 00:58:18 +0000

 Module Name:	othersrc
 Committed By:	lukem
 Date:		Thu Mar 21 00:58:18 UTC 2013

 Update of /cvsroot/othersrc/libexec/tnftpd/src
 In directory ivanova.netbsd.org:/tmp/cvs-serv29049

 Log Message:
 Import NetBSD-ftpd 20100320:
 - Fix warnings and build issues
 - Fix memcpy usage
 - Fix remote crash (fix was already pulled up manually to tnftpd).  PR/43023
 - Reduce priority of syslog message if getpeername returns ENOTCONN.  PR/18934

 Status:

 Vendor Tag:	TNF
 Release Tags:	NetBSD-20130321

 C othersrc/libexec/tnftpd/src/cmds.c
 C othersrc/libexec/tnftpd/src/ftpd.c
 U othersrc/libexec/tnftpd/src/pathnames.h
 U othersrc/libexec/tnftpd/src/ftpusers.5
 C othersrc/libexec/tnftpd/src/popen.c
 U othersrc/libexec/tnftpd/src/ftpd.conf.5
 C othersrc/libexec/tnftpd/src/logutmp.c
 C othersrc/libexec/tnftpd/src/version.h
 U othersrc/libexec/tnftpd/src/ftpd.8
 C othersrc/libexec/tnftpd/src/ftpcmd.y
 C othersrc/libexec/tnftpd/src/extern.h
 U othersrc/libexec/tnftpd/src/logwtmp.c
 C othersrc/libexec/tnftpd/src/Makefile
 C othersrc/libexec/tnftpd/src/conf.c

 9 conflicts created by this import.
 Use the following command to help the merge:

 	cvs checkout -jTNF:yesterday -jTNF othersrc/libexec/tnftpd/src

From: "Alistair G. Crooks" <agc@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/43023 CVS commit: pkgsrc/net/tnftpd
Date: Mon, 25 Mar 2013 04:11:26 +0000

 Module Name:	pkgsrc
 Committed By:	agc
 Date:		Mon Mar 25 04:11:25 UTC 2013

 Modified Files:
 	pkgsrc/net/tnftpd: Makefile distinfo

 Log Message:
 Security fix to tnftpd, to bring the version to 20130325.

 Differences from previous 20100324 version:

 	Mon Mar 25 03:51:20 UTC 2013	lukem

 		* Fix incorrect use of test(1) in configure.

 	Fri Mar 22 09:00:00 UTC 2013	lukem

 		* Release as "tnftpd 20130322"

 		* Update build framekwork to autoconf 2.69, automake 1.11.1,
 		  libtool 2.4.2.

 		* Replace glob with newer copy from NetBSD that does not suffer
 		  from DoS exhaustion attacks.
 		  Fix in NetBSD from Maksymilian Arciemowicz.  See CVE-2010-2632

 		* Update to NetBSD-ftpd 20130321:
 			* Fix warnings and build issues
 			* Fix memcpy usage
 			* Fix remote crash (fix was already pulled up manually to
 			  tnftpd 20100324).  PR/43023 from Bruce Cran.
 			* Reduce priority of syslog message if getpeername returns
 			  ENOTCONN.  PR/18934 from Greg A Woods.

 pkgsrc changes - use pkgsrc libtool and add LICENSE


 To generate a diff of this commit:
 cvs rdiff -u -r1.23 -r1.24 pkgsrc/net/tnftpd/Makefile
 cvs rdiff -u -r1.12 -r1.13 pkgsrc/net/tnftpd/distinfo

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

>Unformatted:

Home	PR Database Search