From e8b450d67708275c85076c07ec60f29c0ea7e87d Mon Sep 17 00:00:00 2001 From: Fabrice Fontaine Date: Tue, 23 Nov 2021 23:36:21 +0100 Subject: [PATCH] package/pure-ftpd: fix CVE-2021-40524 In Pure-FTPd 1.0.49, an incorrect max_filesize quota mechanism in the server allows attackers to upload files of unbounded size, which may lead to denial of service or a server hang. This occurs because a certain greater-than-zero test does not anticipate an initial -1 value. Signed-off-by: Fabrice Fontaine Signed-off-by: Peter Korsgaard (cherry picked from commit 4fd5d8df2a1c468d78ca517e0b304edeebe21ff3) Signed-off-by: Peter Korsgaard --- ...ad-file-size-when-quotas-are-enabled.patch | 33 +++++++++++++++++++ package/pure-ftpd/pure-ftpd.mk | 3 ++ 2 files changed, 36 insertions(+) create mode 100644 package/pure-ftpd/0004-Initialize-the-max-upload-file-size-when-quotas-are-enabled.patch diff --git a/package/pure-ftpd/0004-Initialize-the-max-upload-file-size-when-quotas-are-enabled.patch b/package/pure-ftpd/0004-Initialize-the-max-upload-file-size-when-quotas-are-enabled.patch new file mode 100644 index 0000000000..b269e6cfe7 --- /dev/null +++ b/package/pure-ftpd/0004-Initialize-the-max-upload-file-size-when-quotas-are-enabled.patch @@ -0,0 +1,33 @@ +From 37ad222868e52271905b94afea4fc780d83294b4 Mon Sep 17 00:00:00 2001 +From: Frank Denis +Date: Tue, 23 Nov 2021 18:53:34 +0100 +Subject: [PATCH] Initialize the max upload file size when quotas are enabled + +Due to an unwanted check, files causing the quota to be exceeded +were deleted after the upload, but not during the upload. + +The bug was introduced in 2009 in version 1.0.23 + +Spotted by @DroidTest, thanks! + +[Retrieved from: +https://github.com/jedisct1/pure-ftpd/commit/37ad222868e52271905b94afea4fc780d83294b4] +Signed-off-by: Fabrice Fontaine +--- + src/ftpd.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/src/ftpd.c b/src/ftpd.c +index d856839..be2fd78 100644 +--- a/src/ftpd.c ++++ b/src/ftpd.c +@@ -4247,8 +4247,7 @@ void dostor(char *name, const int append, const int autorename) + if (quota_update("a, 0LL, 0LL, &overflow) == 0 && + (overflow > 0 || quota.files >= user_quota_files || + quota.size > user_quota_size || +- (max_filesize >= (off_t) 0 && +- (max_filesize = user_quota_size - quota.size) < (off_t) 0))) { ++ (max_filesize = user_quota_size - quota.size) < (off_t) 0)) { + overflow = 1; + (void) close(f); + goto afterquota; diff --git a/package/pure-ftpd/pure-ftpd.mk b/package/pure-ftpd/pure-ftpd.mk index 7e3d18b433..35a1aac917 100644 --- a/package/pure-ftpd/pure-ftpd.mk +++ b/package/pure-ftpd/pure-ftpd.mk @@ -21,6 +21,9 @@ PURE_FTPD_IGNORE_CVES += CVE-2020-9365 # 0003-diraliases-always-set-the-tail-of-the-list-to-NULL.patch PURE_FTPD_IGNORE_CVES += CVE-2020-9274 +# 0004-Initialize-the-max-upload-file-size-when-quotas-are-enabled.patch +PURE_FTPD_IGNORE_CVES += CVE-2021-40524 + PURE_FTPD_CONF_OPTS = \ --with-altlog \ --with-puredb