illumos gate

After spending some time on this issue I can see that the issue of resource exhaustion using ftp did not occur.

I ftp'd into a ncp machine from illumos and here are the results

1.)#ftp> ls /..//../*/../*/../*/../*/../*
200 PORT command successful.
150 Opening ASCII mode data connection for file list.
IPS-SVR4
ips-deb
nexenta-gate
onu.sh
packages.i386.tgz
proto
proto.tar
usr
226 Transfer complete.
remote: /..//../*/../*/../*/../*/../*
83 bytes received in 0.00079 seconds (103.25 Kbytes/s)
(As you see there are no duplicate entries either.)

However when I try the regex as given in the CVE this is what happens..
ftp> ls /{..,..}//{..,..}/*/{..,..}/*/{..,..}/*
200 PORT command successful.
550 Arguments too long
ftp>
(From the discussions that Ive gone through it clearly states that this regex is sufficient to bring down a machine but here we can see that this is not allowed at all.)

Apart from this Ive also read the ftpd.c file and found out that there is a fix for a possible DOS already.
http://hg.genunix.org/onnv-gate.hg/file/f835be4545bb/usr/src/cmd/cmd-inet/usr.sbin/in.ftpd/ftpd.c#l7918
(under the fixpath() )

Apart from this the bug reports that 'sftp' is also vulnerable.
Initial tests i did suggests that this problem exists in sftp, however ftp looks clean.

Shampavman

We need to make sure that we are testing an illumos machine, not NCP (unless testing NCP4 prealpha).

Specifically, NCP 3.x probably has a different ftp daemon.

While Nexenta needs to know that NCP3 is free from the problem (or a patch will need to be created), illumos is a separate matter. The interesting change to ftpd was integrated in 140, after the NCP3 was forked from OpenSolaris (which was in build 134.)

The FTP server in oi_148b is version wu-2.6.2+Sun.
It uses a private globbing function called `ftpglob'.
I've built a test program that calls this function in a
similar way to the FTP server. With this, I've verified
that the resource exhaustion bug exists when it's given
a carefully-crafted path.

Oracle has fixed this bug in their copy of the source and
issued patches for it. The original wu-2.6.2 FTP server
has not been maintained for many years. An updated
version is available at http://www.wfms.org/wu-ftpd/ but
even this one has not been maintained since 2009. The
BSD FTP servers appear to be completely different from
the WU version. I'd recommend that the BSD version be
ported to Illumos, replacing the wu-2.6.2+Sun version.

In the interim, I should be able to develop a patch for the
glob.c file that will eliminate the resource exhaustion
vulnerability described in CVE-2010-2632.