[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <20160311172515.5af76630@pc1>
Date: Fri, 11 Mar 2016 17:25:15 +0100
From: Hanno Böck <hanno@...eck.de>
To: oss-security@...ts.openwall.com, cve-assign@...re.org
Subject: Several out of bounds reads in ProFTPD
https://blog.fuzzing-project.org/40-Several-out-of-bounds-reads-in-ProFTPD.html
The latest releases of ProFTPD 1.3.5a and 1.3.6rc2 fix several out of
bounds read issues. I discovered these issues by running the test suite
with Address Sanitizer enabled.
An invalid off by one read can happen in the function pr_fs_dircat().
This affects both 1.3.5a and 1.3.6rc1 and earlier.
http://bugs.proftpd.org/show_bug.cgi?id=4194
Upstream bug report
https://github.com/proftpd/proftpd/commit/f99ef850a05f46c56be8deae97e59efa50575e69
Git commit / fix
An invalid off by one read can happen in the string handling function
pr_ascii_ftp_to_crlf(). This code is not present in the stable 1.3.5
release series and only affects 1.3.6 release candidates before rc2.
http://bugs.proftpd.org/show_bug.cgi?id=4195
Upstream bug report
https://github.com/proftpd/proftpd/pull/145
Git commit / fix
A missing null termination of a string causes an out of bounds memory
read in a test. This does not affect the ProFTPD code itself, it's just
an issue in the test suite.
http://bugs.proftpd.org/show_bug.cgi?id=4193
Upstream bug report
https://github.com/proftpd/proftpd/commit/d9f9d469ce1da09c7935f509797d488fa2d08697
Git commit / fix
--
Hanno Böck
https://hboeck.de/
mail/jabber: hanno@...eck.de
GPG: BBB51E42
Content of type "application/pgp-signature" skipped
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
