CVE-2020-9274
📋 TL;DR
CVE-2020-9274 is an uninitialized pointer vulnerability in Pure-FTPd 1.0.49 that can cause denial of service or potentially allow arbitrary code execution. The vulnerability occurs in directory alias handling functions when they incorrectly traverse linked lists. Organizations running Pure-FTPd servers with directory aliases enabled are affected.
💻 Affected Systems
- Pure-FTPd
📦 What is this software?
Extra Packages For Enterprise Linux by Fedoraproject
View all CVEs affecting Extra Packages For Enterprise Linux →
Extra Packages For Enterprise Linux by Fedoraproject
View all CVEs affecting Extra Packages For Enterprise Linux →
Fedora by Fedoraproject
Fedora by Fedoraproject
Fedora by Fedoraproject
Pure Ftpd by Pureftpd
Ubuntu Linux by Canonical
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise and data exfiltration
Likely Case
Denial of service causing FTP service crashes and disruption of file transfers
If Mitigated
Minimal impact if proper network segmentation and least privilege are implemented
🎯 Exploit Status
Exploitation requires triggering the vulnerable alias functions, which may require specific FTP commands
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.0.50 and later
Vendor Advisory: https://github.com/jedisct1/pure-ftpd/commit/8d0d42542e2cb7a56d645fbe4d0ef436e38bcefa
Restart Required: Yes
Instructions:
1. Download Pure-FTPd 1.0.50 or later from official sources. 2. Stop the Pure-FTPd service. 3. Install the updated version. 4. Restart the Pure-FTPd service.
🔧 Temporary Workarounds
Disable directory aliases
linuxRemove or disable directory alias functionality to prevent triggering the vulnerable code path
# Edit Pure-FTPd configuration and remove any 'Alias' directives
# Or comment out alias lines in configuration files
🧯 If You Can't Patch
- Implement network segmentation to isolate FTP servers from critical systems
- Deploy WAF or IPS rules to detect and block exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check Pure-FTPd version with 'pure-ftpd --version' or 'rpm -q pure-ftpd' on RPM systemsCheck Version:
pure-ftpd --versionVerify Fix Applied:
Verify version is 1.0.50 or later and test directory alias functionality📡 Detection & Monitoring
Log Indicators:
- Pure-FTPd service crashes
- Segmentation fault errors in system logs
- Unusual FTP alias-related commands
Network Indicators:
- Multiple failed FTP connections
- Unusual FTP command sequences targeting alias functions
SIEM Query:
source="pure-ftpd" AND ("segmentation fault" OR "crash" OR "alias")🔗 References
- https://github.com/jedisct1/pure-ftpd/commit/8d0d42542e2cb7a56d645fbe4d0ef436e38bcefa
- https://lists.debian.org/debian-lts-announce/2020/02/msg00029.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22P44PECZWNDP7CMBL7NRBMNFS73C5Z2/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B5NSUDWXZVWUCL6R2PTX3KBB42Z62CA5/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U5DBVHJCXWRSJPNJQCJQCKZF6ZDPZCKA/
- https://security.gentoo.org/glsa/202003-54
- https://usn.ubuntu.com/4515-1/
- https://www.pureftpd.org/project/pure-ftpd/news/
- https://github.com/jedisct1/pure-ftpd/commit/8d0d42542e2cb7a56d645fbe4d0ef436e38bcefa
- https://lists.debian.org/debian-lts-announce/2020/02/msg00029.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22P44PECZWNDP7CMBL7NRBMNFS73C5Z2/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B5NSUDWXZVWUCL6R2PTX3KBB42Z62CA5/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U5DBVHJCXWRSJPNJQCJQCKZF6ZDPZCKA/
- https://security.gentoo.org/glsa/202003-54
- https://usn.ubuntu.com/4515-1/
- https://www.pureftpd.org/project/pure-ftpd/news/
