December 2005

ID: 01131
Ref: 1064/2005
Date: 22 December 2005:12:37:50
Version: 1

---

Title: SCO Security Advisory: OpenServer 5.0.6 OpenServer 5.0.7 OpenServer 6.0.0 : wu-ftp Denial of Service
Abstract: The wu_fnmatch function in wu_fnmatch.c allows remote attackers to cause a denial of service (CPU exhaustion by recursion) via a glob pattern with a large number of * (wildcard) characters, as demonstrated using the dir command.
Vendors affected: SCO
Operating systems affected: SCO
Applications affected: SCO

---

Title
=====

SCO Security Advisory: OpenServer 5.0.6 OpenServer 5.0.7 OpenServer 6.0.0 :
wu-ftp Denial of Service

Detail
======

The wu_fnmatch function in wu_fnmatch.c allows remote attackers
to cause a denial of service (CPU exhaustion by recursion) via a
glob pattern with a large number of * (wildcard) characters, as
demonstrated using the dir command.


- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

______________________________________________________________________________

SCO Security Advisory

Subject: OpenServer 5.0.6 OpenServer 5.0.7 OpenServer 6.0.0 : wu-ftp Denial of Service Vulnerability
Advisory number: SCOSA-2005.63
Issue date: 2005 December 21
Cross reference: sr893936 fz532335 erg712856
sr895049 fz533027 erg712952
CVE-2005-0256
______________________________________________________________________________


1. Problem Description

The wu_fnmatch function in wu_fnmatch.c allows remote attackers
to cause a denial of service (CPU exhaustion by recursion) via a
glob pattern with a large number of * (wildcard) characters, as
demonstrated using the dir command.

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the following name CVE-2005-0256 to this issue.


2. Vulnerable Supported Versions

System Binaries
----------------------------------------------------------------------
OpenServer 5.0.6 /etc/ftpd
OpenServer 5.0.7 /etc/ftpd
OpenServer 6.0.0 /etc/ftpd


3. Solution

The proper solution is to install the latest packages.


4. OpenServer 5.0.6

4.1 Location of Fixed Binaries

ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.63


4.2 Verification

MD5 (p532335.506_vol.tar) = 89ea2ed1f88da6721bd73c3889f9ac0c

md5 is available for download from
ftp://ftp.sco.com/pub/security/tools


4.3 Installing Fixed Binaries

The following package should be installed on your system before you
install this fix:

OSS646C

Upgrade the affected binaries with the following sequence:

1) Download p532335.506_vol.tar to a directory.

2) Extract VOL* files.

# tar xvf p532335.506_vol.tar

3) Run the custom command, specify an install
from media images, and specify the directory as
the location of the images.


5. OpenServer 5.0.7

5.1 Location of Fixed Binaries

The fixes are only available in SCO OpenServer Release 5.0.7
Maintenance Pack 4 or later.

ftp://ftp.sco.com/pub/openserver5/507/mp/osr507mp4/osr507mp4_vol.tar


5.2 Verification

MD5 (osr507mp4_vol.tar) = 4c87d840ff5b43221258547d19030228

md5 is available for download from
ftp://ftp.sco.com/pub/security/tools


5.3 Installing Fixed Binaries

See the SCO OpenServer Release 5.0.7 Maintenance Pack 4 Release
and Installation Notes:

ftp://ftp.sco.com/pub/openserver5/507/mp/osr507mp4/osr507mp4.htm


6. OpenServer 6.0.0

6.1 Location of Fixed Binaries

ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.63


6.2 Verification

MD5 (p533027.600_vol.tar) = d939cb729d115c9bef2d2032903f2125

md5 is available for download from
ftp://ftp.sco.com/pub/security/tools


6.3 Installing Fixed Binaries

Upgrade the affected binaries with the following sequence:

1) Download p533027.600_vol.tar to a directory.

2) Extract VOL* files.

# tar xvf p533027.600_vol.tar

3) Run the custom command, specify an install
from media images, and specify the directory as
the location of the images.


7. References

Specific references for this advisory:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0256
http://www.idefense.com/application/poi/display?id=207&type=vulnerabilities

SCO security resources:
http://www.sco.com/support/security/index.html

SCO security advisories via email
http://www.sco.com/support/forums/security.html

This security fix closes SCO incidents sr893936 fz532335
erg712856 sr895049 fz533027 erg712952.


8. Disclaimer

SCO is not responsible for the misuse of any of the information
we provide on this website and/or through our security
advisories. Our advisories are a service to our customers
intended to promote secure installation and use of SCO
products.


9. Acknowledgments

SCO would like to thank Adam Zabrocki.

______________________________________________________________________________
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (UnixWare)

iD8DBQFDqYDTaqoBO7ipriERAtzOAJ0ctD8xRYQrLkkgyHsMqCvfQdPBFQCeIgx7
xqqmzQCNiw6t+WtSL5rqo4E=
=ha4X
- -----END PGP SIGNATURE-----