Bug 1142 - "Multiple Vendors libc/glob(3) Resource Exhaustion (+0day remote ftpd-anon)"
Summary: "Multiple Vendors libc/glob(3) Resource Exhaustion (+0day remote ftpd-anon)"
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: Cauldron
Hardware: i586 Linux
Priority: Normal normal
Target Milestone: ---
Assignee: Mageia Bug Squad
QA Contact:
URL: http://www.exploit-db.com/exploits/15...
Whiteboard:
Keywords:
Depends on:
Blocks: 908
  Show dependency tree / graph
 
Reported: 2011-05-05 00:46 CEST by Paul Blackburn
Modified: 2011-05-20 08:39 CEST (History)
3 users (show)

See Also:
Source RPM: pure-ftpd
CVE:
Status comment:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description Paul Blackburn 2011-05-05 00:46:06 CEST 
Description of problem:
"Multiple Vendors libc/glob(3) Resource Exhaustion (+0day remote ftpd-anon)"

Version-Release number of selected component (if applicable):

Affects FTPd.
Please read details in http://www.exploit-db.com/exploits/15215/


How reproducible:


Steps to Reproduce:
1.
2.
3.
Ahmad Samir 2011-05-05 01:02:44 CEST

Depends on: (none) => 908

Michael Scherer 2011-05-05 15:40:38 CEST

CC: (none) => misc
Blocks: (none) => 908
Depends on: 908 => (none)

Comment 1 Christiaan Welvaart 2011-05-17 20:40:55 CEST 
The referenced report is about BSD ftpd and BSD libc, neither of which is packaged in Mageia AFAIK. Closing as invalid. If you think this is incorrect, reopen this bug *and* provide more information.

Status: NEW => RESOLVED
CC: (none) => cjw
Resolution: (none) => INVALID

Comment 2 Michael Scherer 2011-05-20 02:28:38 CEST 
Seems pure-ftpd is affected : 
http://www.pureftpd.org/project/pure-ftpd/news 
"Support for braces expansion in directory listings has been disabled â Cf. CVE-2011-0418" 

Mandriva has updated the package to 1.0.32, see  MDVSA-2011:094

Gentoo updated it : http://bugs.gentoo.org/365751 

Fedora didn't yet : https://bugzilla.redhat.com/show_bug.cgi?id=704283

Status: RESOLVED => REOPENED
Resolution: INVALID => (none)
Source RPM: (none) => pure-ftpd

Comment 3 D Morgan 2011-05-20 08:39:55 CEST 
pure-ftpd is now updated in cauldron.

Status: REOPENED => RESOLVED
CC: (none) => dmorganec
Resolution: (none) => FIXED
Note You need to log in before you can comment on or make changes to this bug.