Project

General

Profile

Actions
Copy link

Security #5024

closed
SB JI

ftp: GetLine function buffers data indefinitely if 0x0a was not found int the frag'd input

Security #5024: ftp: GetLine function buffers data indefinitely if 0x0a was not found int the frag'd input

Added by Shivani Bhardwaj about 4 years ago. Updated over 3 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Jason Ish
Target version:
7.0.0-beta1
Affected Versions:
Label:
CVE:
Git IDs:

cf8ed576e09a68886760259055e309e51bf5bec3

Severity:
HIGH
Disclosure Date:

Description

We tend to execute


           ptmp = FTPRealloc(line_state->db, line_state->db_len,
                             (line_state->db_len + state->input_len));
            if (ptmp == NULL) {
                FTPFree(line_state->db, line_state->db_len);
                line_state->db = NULL;
                line_state->db_len = 0; 
                return -1;
            }
            line_state->db = ptmp;

            memcpy(line_state->db + line_state->db_len,
                   state->input, state->input_len);
            line_state->db_len += state->input_len;
        }    
        state->input += state->input_len;
        state->input_len = 0;

indefinitely.

Related issues 4 (0 open — 4 closed)

Related to Suricata - Bug #5235: ftp: add event when command request or response is too longClosedJason IshActions
Related to Suricata - Bug #5281: ftp: don't let first incomplete segment be over maximum lengthClosedJason IshActions
Copied to Suricata - Security #5025: ftp: GetLine function buffers data indefinitely if 0x0a was not found int the frag'd inputClosedJason IshActions
Copied to Suricata - Security #5026: ftp: GetLine function buffers data indefinitely if 0x0a was not found in the frag'd inputClosedJason IshActions

SB Updated by Shivani Bhardwaj about 4 years ago Actions
Copy link
 #1

  • Copied to Security #5025: ftp: GetLine function buffers data indefinitely if 0x0a was not found int the frag'd input added

SB Updated by Shivani Bhardwaj about 4 years ago Actions
Copy link
 #2

  • Copied to Security #5026: ftp: GetLine function buffers data indefinitely if 0x0a was not found in the frag'd input added

JI Updated by Jason Ish almost 4 years ago Actions
Copy link
 #3

  • Status changed from Assigned to In Review
  • Assignee changed from Shivani Bhardwaj to Jason Ish

JI Updated by Jason Ish almost 4 years ago Actions
Copy link
 #4

  • Related to Bug #5235: ftp: add event when command request or response is too long added

VJ Updated by Victor Julien almost 4 years ago Actions
Copy link
 #5

  • Tracker changed from Bug to Security
  • Severity set to HIGH

VJ Updated by Victor Julien almost 4 years ago Actions
Copy link
 #6

  • Status changed from In Review to Closed
  • Git IDs updated (diff)

JI Updated by Jason Ish almost 4 years ago Actions
Copy link
 #7

  • Related to Bug #5281: ftp: don't let first incomplete segment be over maximum length added

VJ Updated by Victor Julien over 3 years ago Actions
Copy link
 #8

  • Private changed from Yes to No
  • Label deleted (Needs backport to 5.0, Needs backport to 6.0)
Actions
Copy link

Also available in: PDF Atom