[Bug 2048764] [NEW] [SRU] pure-ftpd-postgresql 1.0.50 segfaults after client connects
Launchpad Bug Tracker
2048764 at bugs.launchpad.net
Tue Jan 9 22:28:01 UTC 2024
You have been subscribed to a public bug by Sudip Mukherjee (sudipmuk):
[ Impact ]
pure-ftpd-postgresql is completely unusable as it will always segfault
whenever any user tries to connect to the ftp server.
[ Test Plan ]
* Install pure-ftpd-postgresql and postgresql
* open /etc/pure-ftpd/db/postgresql.conf and modify PGSQLCrypt to use
'cleartext'
* use the command "sudo systemctl restart pure-ftpd-postgresql.service"
to restart pure-ftpd which will now use the modified conf file.
* Use the following command to create the postgresql database which pure-ftpd will use.
- sudo -u postgres createdb pureftpd
* Use the following command to use psql to connect the db
- sudo -u postgres psql pureftpd
* while connected use the followwing commands:
- ALTER USER postgres WITH PASSWORD 'rootpw';
- CREATE TABLE "users" (
"User" TEXT NOT NULL,
"Password" TEXT NOT NULL,
"Uid" INTEGER NOT NULL default '-1',
"Gid" INTEGER NOT NULL default '-1',
"Dir" TEXT NOT NULL,
PRIMARY KEY ("User")
) WITHOUT OIDS;
- insert into users values ('sudip', 'test', 1000, 1000, '/home/sudip');
- enter \q to exit psql
* The above commands are for my test environment. Please modify username
or cleartext password or uid or gid as appropriate for anyone else
testing.
* Use the following command to connect to the ftp server:
- ftp localhost
- enter username and password as given in the psql insert command. For my environment, username is 'sudip', and password is 'test'.
* If the package is not fixed it will end with:
421 Service not available, remote server has closed connection.
ftp: Login failed
and dmesg will show there was a segfault from pure-ftpd-postgresql
* With the fixed package, it will connect to the ftp server.
[ Where problems could occur ]
* This is an upstream patch which is only changing the port number it is using to connect to the postgresql server. There is no other change. At the worst case, it will not be able to connect to the postgresql server and user will not be able to login to the ftp server.
* It is already completely unusable for users, and this will not cause any more regression than what user experiences now.
[ Other Info ]
* All versions from v1.0.50 is affected so only Focal is unaffected.
[ Original Bug Description ]
This is essentially a duplicate of Debian bug
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1058796
After a client connects to pure-ftpd-postgresql 1.0.50, the server
establishes the TLS connection, authenticates the user and segfaults
immediately after that, interrupting the connection in the process.
```
$ lsb_release -rd
Description: Ubuntu 22.04.3 LTS
Release: 22.04
```
```
$ apt-cache policy pure-ftpd-postgresql
pure-ftpd-postgresql:
Installed: 1.0.50-2.1
Candidate: 1.0.50-2.1
Version table:
*** 1.0.50-2.1 500
500 http://cz.archive.ubuntu.com/ubuntu jammy/universe amd64 Packages
100 /var/lib/dpkg/status
```
```
Jan 9 10:26:42 info pure-ftpd-postgresql[497741]: Running: /usr/sbin/pure-ftpd-postgresql -l pgsql:/etc/pure-ftpd/db/postgresql.conf -A -D -J ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384 -H -Y 1 -O clf:/var/log/pure-ftpd/transfer.log -u 1 -b -E -p 40000:49999 -B
Jan 9 10:26:42 info systemd[1]: Started pure-ftpd-postgresql.service.
Jan 9 10:26:52 info kernel: [347086.735293] pure-ftpd-postg[497765]: segfault at 1538 ip 00007f4f4dbb1ebc sp 00007ffe6df88698 error 4 in libc.so.6[7f4f4da28000+195000] likely on CPU 6 (core 3, socket 0)
Jan 9 10:26:52 info kernel: [347086.735338] Code: 00 00 00 00 00 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 89 f8 62 a1 fd 00 ef c0 25 ff 0f 00 00 3d e0 0f 00 00 0f 87 34 01 00 00 <62> f3 7d 20 3f 07 00 c5 fb 93 c0 85 c0 74 55 f3 0f bc c0 c3 f3 0f
Jan 9 10:26:57 info kernel: [347091.872524] pure-ftpd-postg[497779]: segfault at 1538 ip 00007f4f4dbb1ebc sp 00007ffe6df88698 error 4 in libc.so.6[7f4f4da28000+195000] likely on CPU 6 (core 3, socket 0)
Jan 9 10:26:57 info kernel: [347091.872562] Code: 00 00 00 00 00 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 89 f8 62 a1 fd 00 ef c0 25 ff 0f 00 00 3d e0 0f 00 00 0f 87 34 01 00 00 <62> f3 7d 20 3f 07 00 c5 fb 93 c0 85 c0 74 55 f3 0f bc c0 c3 f3 0f
Jan 9 10:36:24 info kernel: [347659.224784] pure-ftpd-postg[498601]: segfault at 1538 ip 00007f4f4dbb1ebc sp 00007ffe6df88698 error 4 in libc.so.6[7f4f4da28000+195000] likely on CPU 4 (core 2, socket 0)
Jan 9 10:36:24 info kernel: [347659.224806] Code: 00 00 00 00 00 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 89 f8 62 a1 fd 00 ef c0 25 ff 0f 00 00 3d e0 0f 00 00 0f 87 34 01 00 00 <62> f3 7d 20 3f 07 00 c5 fb 93 c0 85 c0 74 55 f3 0f bc c0 c3 f3 0f
Jan 9 10:36:30 info kernel: [347665.416357] pure-ftpd-postg[498611]: segfault at 1538 ip 00007f4f4dbb1ebc sp 00007ffe6df88698 error 4 in libc.so.6[7f4f4da28000+195000] likely on CPU 4 (core 2, socket 0)
Jan 9 10:36:30 info kernel: [347665.416396] Code: 00 00 00 00 00 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 89 f8 62 a1 fd 00 ef c0 25 ff 0f 00 00 3d e0 0f 00 00 0f 87 34 01 00 00 <62> f3 7d 20 3f 07 00 c5 fb 93 c0 85 c0 74 55 f3 0f bc c0 c3 f3 0f
```
The bug is already fixed in upstream via
https://github.com/jedisct1/pure-
ftpd/commit/c3f0f3c91d86939e6fabf5f65c6c6fc964e6032e
** Affects: pure-ftpd (Ubuntu)
Importance: Undecided
Status: Confirmed
** Affects: pure-ftpd (Ubuntu Jammy)
Importance: Undecided
Status: Confirmed
** Affects: pure-ftpd (Ubuntu Lunar)
Importance: Undecided
Status: Confirmed
** Affects: pure-ftpd (Ubuntu Mantic)
Importance: Undecided
Status: Confirmed
** Affects: pure-ftpd (Debian)
Importance: Unknown
Status: New
** Tags: jammy lunar mantic noble
--
[SRU] pure-ftpd-postgresql 1.0.50 segfaults after client connects
https://bugs.launchpad.net/bugs/2048764
You received this bug notification because you are a member of Ubuntu Sponsors, which is subscribed to the bug report.
More information about the Ubuntu-sponsors
mailing list