Source: vsftpd Version: 3.0.5-1 Severity: normal Tags: security upstream patch
Hi, CVE-2026-119567 is listed as undetermined and has no Debian bug. It does affect Debian, and a small patch is attached. process_post_login() in postlogin.c compares cmds_denied against the literal command name, but XPWD, XCWD, XCUP, XMKD and XRMD run the same handlers as PWD, CWD, CDUP, MKD and RMD. So a site that denies RMD still allows XRMD. The check is the same in 3.0.5-1, 3.0.5-0.2 and 3.0.3-13. It only matters on servers that set cmds_denied, which is not the default. The patch treats an alias as its target for the deny check only. cmds_allowed is unchanged, since it already fails closed for an unlisted alias. An alias can still be denied by its own name. Test: I built 3.0.5-1 with the Debian patch series, with and without the patch, with PAM, SSL and tcp_wrappers disabled in builddefs.h, and ran it on loopback as an anonymous user. With cmds_denied=RMD,MKD,CWD,PWD,CDUP, unpatched: the five plain commands get "Permission denied", while the aliases are not refused by the check. XPWD returned 257 and XCUP returned 250, and XMKD, XRMD and XCWD reached their handlers and failed only because my test directory was unreachable for the test user. Patched: all ten commands get "Permission denied", and NOOP still works. With cmds_denied=RMD, patched: only RMD and XRMD are refused. The other commands and aliases behave as they do unpatched. The patch applies to all three versions after the Debian series. postlogin.c compiles with it on 3.0.5-0.2 and 3.0.3-13, but I only ran the test on 3.0.5-1. I did not do a full package build, and I did not test with local users or PAM. Regards, Sumit Verma
Description: Apply cmds_denied to the RFC 775 command aliases XPWD, XCWD, XCUP, XMKD and XRMD run the same handlers as PWD, CWD, CDUP, MKD and RMD, but the cmds_denied check compares only the literal command name, so denying RMD did not deny XRMD. Treat an alias as its target for this check. An alias can still be denied by its own name. Author: Sumit Verma <[email protected]> Bug-Debian-Security: CVE-2026-119567 Forwarded: not-needed Last-Update: 2026-11-08 --- --- a/postlogin.c +++ b/postlogin.c @@ -80,6 +80,33 @@ static int data_transfer_checks_ok(struct vsf_session* p_sess); static void resolve_tilde(struct mystr* p_str, struct vsf_session* p_sess); +/* RFC 775 aliases run the same handlers as these commands. */ +static const char* +get_cmd_alias_target(const struct mystr* p_cmd_str) +{ + if (str_equal_text(p_cmd_str, "XPWD")) + { + return "PWD"; + } + if (str_equal_text(p_cmd_str, "XCWD")) + { + return "CWD"; + } + if (str_equal_text(p_cmd_str, "XCUP")) + { + return "CDUP"; + } + if (str_equal_text(p_cmd_str, "XMKD")) + { + return "MKD"; + } + if (str_equal_text(p_cmd_str, "XRMD")) + { + return "RMD"; + } + return 0; +} + void process_post_login(struct vsf_session* p_sess) { @@ -162,6 +189,7 @@ { static struct mystr s_src_str; static struct mystr s_rhs_str; + const char* p_alias_target = get_cmd_alias_target(&p_sess->ftp_cmd_str); str_alloc_text(&s_src_str, tunable_cmds_denied); while (1) { @@ -170,7 +198,9 @@ { break; } - else if (str_equal(&s_src_str, &p_sess->ftp_cmd_str)) + else if (str_equal(&s_src_str, &p_sess->ftp_cmd_str) || + (p_alias_target != 0 && + str_equal_text(&s_src_str, p_alias_target))) { cmd_ok = 0; break;
