Subject: proftpd-basic: segfault in TLS mode with certificate when strlen on NULL string Package: proftpd-basic Version: 1.3.4a-5+deb7u1 Severity: important Tags: upstream patch
-- System Information: Debian Release: 7.6 APT prefers stable-updates APT policy: (500, 'stable-updates'), (500, 'stable') Architecture: amd64 (x86_64) Kernel: Linux 3.2.0-4-amd64 (SMP w/8 CPU cores) Locale: LANG=fr_FR.UTF-8, LC_CTYPE=fr_FR.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Versions of packages proftpd-basic depends on: ii adduser 3.113+nmu3 ii debconf 1.5.49 ii debianutils 4.3.2 ii libacl1 2.2.51-8 ii libc6 2.13-38+deb7u4 ii libcap2 1:2.22-1.2 ii libncurses5 5.9-10 ii libpam-runtime 1.1.3-7.1 ii libpam0g 1.1.3-7.1 ii libpcre3 1:8.30-5 ii libssl1.0.0 1.0.1e-2+deb7u12 ii libtinfo5 5.9-10 ii libwrap0 7.6.q-24 ii netbase 5.0 ii sed 4.2.1-10 ii ucf 3.0025+nmu3 ii update-inetd 4.43 ii zlib1g 1:1.2.7.dfsg-13 Versions of packages proftpd-basic recommends: ii proftpd-mod-vroot 0.9.2-2+b2 Versions of packages proftpd-basic suggests: pn openbsd-inetd | inet-superserver <none> ii openssl 1.0.1e-2+deb7u12 pn proftpd-doc <none> pn proftpd-mod-ldap <none> pn proftpd-mod-mysql <none> pn proftpd-mod-odbc <none> pn proftpd-mod-pgsql <none> pn proftpd-mod-sqlite <none> -- debconf information excluded I use proftpd with TLS configuration like: # TLS <IfModule mod_tls.c> TLSEngine on TLSLog /home/debian/test/proftpd/logs/proftpd_tls.log ALL TLSProtocol SSLv23 # TLSProtocol TLSv1 # reject protection of the data channel TLSRequired !data TLSOptions AllowDotLogin # Server's certificate TLSRSACertificateFile /etc/ssl/certs/proftpd.cert.pem TLSRSACertificateKeyFile /etc/ssl/certs/proftpd.key.pem # Authenticate clients that want to use FTP over TLS? TLSVerifyClient off # Change renegotiations so that they are not required, only requested TLSRenegotiate required off </IfModule> And then try to connect to it using certificates with a commande like: curl -v --ftp-create-dirs -k --ftp-ssl-control -u debian:null -E ~/.ssl/ftps.cat.pem ftp://server//home/debian/toto proftpd then segfaults on line 269 of modules/mod_auth.c: passwd_len = strlen(cmd->arg); cmd->arg is NULL in this configuration, and strlen segfaults. To solve the bug, this line can be replaced by: passwd_len = (cmd->arg == NULL) ? 0 : strlen(cmd->arg); -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
