Off-by-one error in the fsp_readdir_r function in fsplib.c in fsplib before 0.9 allows remote attackers to cause a denial of service via a directory entry whose length is exactly MAXNAMELEN, which prevents a terminating null byte from being added.

Kalle Olavi Niemitalo found two boundary errors in the fsplib library, a copy of which is included in gFTP source. A remote attacker could trigger these vulnerabilities by enticing a user to download a file with a specially crafted directory or file name, possibly resulting in the execution of arbitrary code (CVE-2007-3962) or a denial of service (CVE-2007-3961).

The updated packages have been patched to correct these issues.

Gentoo reports :

Kalle Olavi Niemitalo discovered two boundary errors in fsplib code included in gFTP when processing overly long directory or file names.

A remote attacker could trigger these vulnerabilities by enticing a user to download a file with a specially crafted directory or file name, possibly resulting in the execution of arbitrary code or a Denial of Service.

The remote host is affected by the vulnerability described in GLSA-200711-01 (gFTP: Multiple vulnerabilities)

    Kalle Olavi Niemitalo discovered two boundary errors in fsplib code     included in gFTP when processing overly long directory or file names.
  Impact :

    A remote attacker could trigger these vulnerabilities by enticing a     user to download a file with a specially crafted directory or file     name, possibly resulting in the execution of arbitrary code     (CVE-2007-3962) or a Denial of Service (CVE-2007-3961).
  Workaround :

    There is no known workaround at this time.

A Secunia Advisory reports :

fsplib can be exploited to compromise an application using the library.

A boundary error exists in the processing of file names in fsp_readdir_native, which can be exploited to cause a stack-based buffer overflow if the defined MAXNAMLEN is bigger than 256.

A boundary error exists in the processing of directory entries in fsp_readdir, which can be exploited to cause a stack-based buffer overflow on systems with an insufficient size allocated for the d_name field of directory entries.

ID	Name	Product	Family	Severity
38128	Mandriva Linux Security Advisory : gftp (MDVSA-2008:018)	Nessus	Mandriva Local Security Checks	high
27641	FreeBSD : gftp -- multiple vulnerabilities (f8b0f83c-8bb3-11dc-bffa-0016179b2dd5)	Nessus	FreeBSD Local Security Checks	high
27611	GLSA-200711-01 : gFTP: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
25841	FreeBSD : fsplib -- multiple vulnerabilities (4a338d17-412d-11dc-bdb0-0016179b2dd5)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2007-3961

high

Tenable Plugins

high

high

high

high