/ Bug 3973 – mod_sftp can be forced to allocate too much memory for keyboard-interactive authentication
First Last Prev Next    No search results available
Bug 3973 - mod_sftp can be forced to allocate too much memory for keyboard-interactive authentication
: mod_sftp can be forced to allocate too much memory for keyboard-interactive a...
Status: CLOSED FIXED
Product: ProFTPD
mod_sftp
: 1.3.4
: All All
: P2 major
Assigned To: TJ Saunders
:
: Backport
:
:
  Show dependency tree / graph
 
Reported: 2013-09-12 00:38 UTC by TJ Saunders
Modified: 2014-01-28 18:50 UTC (History)
6 users (show)

See Also:

Attachments
Fixes bug (1.32 KB, patch)
2013-09-12 16:37 UTC, TJ Saunders 		Details
Better patch (4.94 KB, patch)
2013-09-13 18:42 UTC, TJ Saunders 		Details
Show Obsolete (1) Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description TJ Saunders 2013-09-12 00:38:42 UTC 
When mod_sftp is configured to support/use keyboard-interactive authentication,
via the mod_sftp_pam module, then it is possible for a client to force mod_sftp
to allocate too much memory, and crash the process.

See:

  http://kingcope.wordpress.com/2013/09/11/proftpd-mod_sftpmod_sftp_pam-invali
d-pool-allocation-in-kbdint-authentication/
Comment 1 TJ Saunders 2013-09-12 00:42:27 UTC 
Better URL (copy-paste broke the last one):

 
http://kingcope.wordpress.com/2013/09/11/proftpd-mod_sftpmod_sftp_pam-invalid-pool-allocation-in-kbdint-authentication/
Comment 2 TJ Saunders 2013-09-12 16:37:34 UTC 
Created attachment 4072 [details]
Fixes bug

This patch addresses the issue by imposing an upper bound on the response count
sent by the client; the upper bound is defined to be 500.
Comment 3 TJ Saunders 2013-09-13 18:42:15 UTC 
Created attachment 4075 [details]
Better patch

This patch is better, as it ensures both that a) the received response count
matches the number of challenges sent, and b) that the received response count
is not too high (as an additional sanity check); the upper bound is still set
to 500.
Comment 4 TJ Saunders 2013-09-14 06:57:44 UTC 
Patch committed to CVS, and backported to 1.3.4 branch.
Comment 5 TJ Saunders 2013-09-17 05:03:03 UTC 
For future reference, this issue has been assigned as CVE-2013-4359.
Comment 6 TJ Saunders 2014-01-28 18:50:32 UTC 
Resolved in 1.3.5rc4.
First Last Prev Next    No search results available