Access of Uninitialized Pointer in Pure-FTPd - CVE-2020-9274

Vulnerability identifier: #VU25651

CSH Severity: Low

CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-9274

CWE-ID: CWE-824

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to access to an uninitialized pointer in init_aliases() function in diraliases.c when processing liked. A remote user with ability to create aliases can crash the server.

Pure-FTPd
Gentoo Linux
Fedora
Ubuntu
pure-ftpd (Alpine package)
pure-ftpd (Ubuntu package)
pure-ftpd-common (Ubuntu package)
pure-ftpd-ldap (Ubuntu package)
pure-ftpd-mysql (Ubuntu package)
pure-ftpd-postgresql (Ubuntu package)
pure-ftpd

Install update from vendor's website.

Pure-FTPd - update to 1.0.50
pure-ftpd (Alpine package) - update to 1.0.49-r1
pure-ftpd (Ubuntu package) - update to 1.0.36-3.2+deb8u1build0.16.04.1
pure-ftpd-common (Ubuntu package) - update to 1.0.36-3.2+deb8u1build0.16.04.1
pure-ftpd-ldap (Ubuntu package) - update to 1.0.36-3.2+deb8u1build0.16.04.1
pure-ftpd-mysql (Ubuntu package) - update to 1.0.36-3.2+deb8u1build0.16.04.1
pure-ftpd-postgresql (Ubuntu package) - update to 1.0.36-3.2+deb8u1build0.16.04.1
pure-ftpd - addressed in versions 1.0.47-4.el7, 1.0.49-4.el8, 1.0.49-5.fc30, 1.0.49-5.fc31, 1.0.49-5.fc32

• https://github.com/jedisct1/pure-ftpd/commit/8d0d42542e2cb7a56d645fbe4d0ef436e38bcefa
• https://www.pureftpd.org/project/pure-ftpd/news/

• Multiple vulnerabilities in Pure-FTPd
• Gentoo update for Pure-FTPd
• Access of Uninitialized Pointer in pure-ftpd (Alpine package)
• Ubuntu update for pure-ftpd
• Fedora 32 update for pure-ftpd
• Fedora 31 update for pure-ftpd
• Fedora 30 update for pure-ftpd
• Fedora EPEL 8 update for pure-ftpd
• Fedora EPEL 7 update for pure-ftpd