From: kjm@rins.ryukoku.ac.jp (KOJIMA Hajime /
    =?ISO-2022-JP?B?GyRCPi5FZ0glGyhC?=)
To: ftpd@jp.win.ne.jp
Subject: [ftpd 600] [FYI] wu-ftpd 2.5.0 mapped_path buffer overrun 
Mime-Version: 1.0
Content-Type: text/plain; charset=iso-2022-jp
Date: Thu, 26 Aug 1999 20:48:21 +0900
Message-ID: <90512.935668101@ideon.st.ryukoku.ac.jp>
Sender: owner-ftpd@jp.win.ne.jp
Reply-To: ftpd@jp.win.ne.jp
Precedence: bulk

  すでにみなさんご存じかもしれませんが:

  wu-ftpd 2.5.0 / BeroFTPD に buffer overrun する弱点があると指摘され
  ています。日付が変なのは nimue.ids.pl のせいのようです。

<http://www.securityfocus.com/templates/archive.pike?list=1&date=1999-07-1&msg=lcamtuf.4.05.9907041223290.355-300000@nimue.ids.pl>

  これをうけて RedHat Linux では wu-ftpd 新パッケージが出てます。以下
  は 6.0 の URL ですが、5.2/4.2 も同様。

<http://www.redhat.com/corp/support/errata/RHSA1999031_01.html>

  RedHat の src rpm に含まれていた fix patch を以下に示します: 

Index: src/ftpd.c
===================================================================
RCS file: /cvsroot/wu-ftpd-stable/src/ftpd.c,v
retrieving revision 1.21
diff -c -r1.21 ftpd.c
*** src/ftpd.c	1999/05/20 16:37:40	1.21
--- src/ftpd.c	1999/08/25 02:31:08
***************
*** 1211,1216 ****
--- 1211,1223 ----
        return path;
  }
  
+ char *mapping_getcwd(char *path, size_t size)
+ {
+     strncpy(path, mapped_path, size);
+     path[size-1] = '\0';
+     return path;
+ }
+ 
  /* Make these globals rather than local to mapping_chdir to avoid stack overflow */
  char pathspace[ MAXPATHLEN ];
  char old_mapped_path[ MAXPATHLEN ];
***************
*** 1244,1251 ****
  
        /* append the dir part with a leading / unless at root */
        if( !(mapped_path[0] == '/' && mapped_path[1] == '\0') )
                strcat( mapped_path, "/" );
!       strcat( mapped_path, dir );
  }
  
  int
--- 1251,1260 ----
  
        /* append the dir part with a leading / unless at root */
        if( !(mapped_path[0] == '/' && mapped_path[1] == '\0') )
+           if (strlen(mapped_path) < sizeof(mapped_path)-1)
                strcat( mapped_path, "/" );
!    if (sizeof(mapped_path)-strlen(mapped_path) > 1)
!       strncat( mapped_path, dir, sizeof(mapped_path)-strlen(mapped_path)-1 );
  }
  
  int
***************
*** 1293,1299 ****
  
  #define chdir(d) mapping_chdir(d)
  #define getwd(d) mapping_getwd(d)
! #define getcwd(d,u) mapping_getwd(d)
  
  #endif /* MAPPING_CHDIR */
  
--- 1302,1308 ----
  
  #define chdir(d) mapping_chdir(d)
  #define getwd(d) mapping_getwd(d)
! #define getcwd(d,u) mapping_getcwd((d),(u))
  
  #endif /* MAPPING_CHDIR */
  
----
// 中日ドラゴンズ マジック 26!  今年こそ優勝だ!!

小島 肇 - KOJIMA Hajime
[Office] kjm@rins.ryukoku.ac.jp, http://www.st.ryukoku.ac.jp/~kjm/
         Phone: 077-543-7414  Fax: 077-543-0706