CVE-2020-9365: Pure-FTPd Buffer Overflow Vulnerability

CVE-2020-9365 Overview

An out-of-bounds (OOB) read vulnerability has been discovered in Pure-FTPd 1.0.49, affecting the pure_strcmp function located in utils.c. This memory corruption issue allows remote attackers to potentially read sensitive information from server memory by exploiting improper string length validation during comparison operations.

Critical Impact

Remote attackers can exploit this out-of-bounds read vulnerability over the network without authentication, potentially accessing sensitive data from server memory including credentials, session tokens, or other confidential information.

Affected Products

• Pure-FTPd 1.0.49
• Fedora 30, 31, and 32 (with vulnerable Pure-FTPd packages)
• Linux distributions using affected Pure-FTPd versions

Discovery Timeline

• 2020-02-24 - CVE-2020-9365 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2020-9365

Vulnerability Analysis

The vulnerability resides in the pure_strcmp function within utils.c, where improper string length handling leads to an out-of-bounds read condition. The original implementation used only the length of the first string (s1) when performing memory comparison, failing to account for cases where the second string (s2) might be longer. This allows the comparison to read beyond the allocated buffer of s1, potentially exposing adjacent memory contents.

This vulnerability is classified as CWE-125 (Out-of-bounds Read), which occurs when the software reads data past the end or before the beginning of the intended buffer. In the context of Pure-FTPd, this could be triggered during various authentication and protocol handling operations where string comparisons are performed.

Root Cause

The root cause lies in the flawed logic of the original pure_strcmp function. The function called pure_memcmp with a length parameter derived solely from strlen(s1) + 1U, without validating whether s2 had a different length. When s2 is longer than s1, the memory comparison would read past the null terminator of s1, accessing memory outside the intended bounds.

Attack Vector

The attack vector is network-based, requiring no prior authentication or user interaction. An attacker can craft malicious FTP requests containing specially crafted strings that trigger the vulnerable comparison function. By analyzing responses or timing differences, attackers may be able to extract information from the server's memory space.

// Original vulnerable code in pure_strcmp function
int pure_strcmp(const char * const s1, const char * const s2)
{
    return pure_memcmp(s1, s2, strlen(s1) + 1U);
}

// Patched version that properly validates string lengths
int pure_strcmp(const char * const s1, const char * const s2)
{
    const size_t s1_len = strlen(s1);
    const size_t s2_len = strlen(s2);

    if (s1_len != s2_len) {
        return -1;
    }
    return pure_memcmp(s1, s2, s1_len);
}

Source: GitHub Commit 36c6d26

Detection Methods for CVE-2020-9365

Indicators of Compromise

• Unusual FTP connection patterns with abnormally long input strings
• Repeated authentication attempts with varying string lengths designed to probe memory
• FTP server crashes or unexpected behavior following malformed requests
• Memory access violations logged by system monitoring tools

Detection Strategies

• Monitor FTP server logs for malformed commands containing unusual string patterns
• Deploy network intrusion detection systems (IDS) with signatures for Pure-FTPd exploitation attempts
• Implement application-level monitoring to detect out-of-bounds memory access events
• Use memory sanitizers (AddressSanitizer) in development and testing environments to identify OOB reads

Monitoring Recommendations

• Enable verbose logging on Pure-FTPd servers to capture detailed connection information
• Configure system-level auditing to detect process crashes and memory violations
• Monitor network traffic for anomalous FTP protocol behavior
• Set up alerts for repeated failed authentication attempts from single sources

How to Mitigate CVE-2020-9365

Immediate Actions Required

• Update Pure-FTPd to a version that includes the security patches
• Apply vendor-provided patches from Fedora, Gentoo, or your distribution's security updates
• Review FTP server access logs for signs of exploitation attempts
• Consider temporarily restricting FTP access to trusted networks until patching is complete

Patch Information

The Pure-FTPd development team has released patches addressing this vulnerability. Two commits fix the out-of-bounds read issue in the pure_strcmp function:

• First patch commit - Adds explicit length comparison before memory comparison
• Second patch commit - Alternative fix using minimum length comparison

Distribution-specific updates are available through Fedora Package Announcements and Gentoo GLSA 202003-54.

Workarounds

• Restrict network access to the FTP server using firewall rules to limit exposure
• Implement connection rate limiting to reduce potential exploitation attempts
• Consider using SFTP or FTPS alternatives that may not be affected by this specific vulnerability
• Deploy a web application firewall (WAF) or network-based filtering to inspect FTP traffic

# Restrict FTP access to trusted networks using iptables
iptables -A INPUT -p tcp --dport 21 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 21 -j DROP

# Check current Pure-FTPd version
pure-ftpd --version

# Update Pure-FTPd on Fedora systems
dnf update pure-ftpd