vsftpd vulnerable to heartbleed (according to testssl)

[AlainKnaff]

According to testssl (from https://testssl.sh/testssl.sh) vsftpd is vulnerable to heartbleed, with now obvious way (in the config) to secure it:

testssl@will:~$ ./testssl.sh -t ftp lll.lu:21
...
 Heartbleed (CVE-2014-0160) VULNERABLE (NOT ok)

Or is this a shortcoming of the testssl script, which reports a vulnerability where there is none? If this is the case, could anybody explain how the error happens, so that we can get testssl fixed?

1) root@lll:~# lsb_release -rd
Description: Ubuntu 14.04.4 LTS
Release: 14.04
2) root@lll:~# apt-cache policy vsftpd
vsftpd:
  Installed: 3.0.2-1ubuntu2.14.04.1
  Candidate: 3.0.2-1ubuntu2.14.04.1
  Version table:
 *** 3.0.2-1ubuntu2.14.04.1 0
        500 http://be.archive.ubuntu.com/ubuntu/ trusty-updates/main amd64 Packages
        100 /var/lib/dpkg/status
     3.0.2-1ubuntu2 0
        500 http://be.archive.ubuntu.com/ubuntu/ trusty/main amd64 Packages

3) What I expected to happen
 Heartbleed (CVE-2014-0160) not vulnerable (OK) (timed out)

4) What did happen
 Heartbleed (CVE-2014-0160) VULNERABLE (NOT ok)

[Joshua Powers (powersj)]

There appears to be a bug report around a false positive with testssl.sh [1] and fix [2] specific to vsftpd. This was reported after this bug report, so I am wondering if you could retest. For now I am marking this as 'incomplete', if you get newer results please mark this as 'new'.

I would also be curious to see your vsftpd.conf file to know how you are configuring it.

[1] https://github.com/drwetter/testssl.sh/issues/426
[2] https://github.com/drwetter/testssl.sh/commit/d1cc7b3755478f302a5f957e2bbcaf17899951fc

[AlainKnaff (kubuntu-misc)]

I just re-downloaded the current version of testssl.sh (dated December 20th 2016), and tried again, and vsftpd is still shown to be vulnerable to Heartbleed.

[Joshua Powers (powersj)]

Thanks for the response. Any chance I could see your vsftpd.conf file and know what versions of openssl and libssl1.0.0 are installed? I ask because I was unable to reproduce.

I've pasted the results of my testssl.sh [1] and vsftpd.conf [2], and the versions of vsftpd, openssl, and libssl1.0.0 [3].

[1] https://paste.ubuntu.com/23863796/
[2] https://paste.ubuntu.com/23863798/
[3] https://paste.ubuntu.com/23863808/

[AlainKnaff (kubuntu-misc)]

> Any chance I could see your vsftpd.conf file

Sure, here it is:

# Example config file /etc/vsftpd.conf
#
# The default compiled in settings are fairly paranoid. This sample file
# loosens things up a bit, to make the ftp daemon more usable.
# Please see vsftpd.conf.5 for all compiled in defaults.
#
# READ THIS: This example file is NOT an exhaustive list of vsftpd options.
# Please read the vsftpd.conf.5 manual page to get a full idea of vsftpd's
# capabilities.
#
#
# Run standalone? vsftpd can run either from an inetd or as a standalone
# daemon started from an initscript.
listen=YES
#
# Run standalone with IPv6?
# Like the listen parameter, except vsftpd will listen on an IPv6 socket
# instead of an IPv4 one. This parameter and the listen parameter are mutually
# exclusive.
#listen_ipv6=YES
#
# Allow anonymous FTP? (Disabled by default)
anonymous_enable=YES
#
# Uncomment this to allow local users to log in.
local_enable=YES
#
# Uncomment this to enable any form of FTP write command.
write_enable=YES
#
# Default umask for local users is 077. You may wish to change this to 022,
# if your users expect that (022 is used by most other ftpd's)
local_umask=022
#
# Uncomment this to allow the anonymous FTP user to upload files. This only
# has an effect if the above global write enable is activated. Also, you will
# obviously need to create a directory writable by the FTP user.
#anon_upload_enable=YES
#
# Uncomment this if you want the anonymous FTP user to be able to create
# new directories.
#anon_mkdir_write_enable=YES
#
# Activate directory messages - messages given to remote users when they
# go into a certain directory.
dirmessage_enable=YES
#
# If enabled, vsftpd will display directory listings with the time
# in your local time zone. The default is to display GMT. The
# times returned by the MDTM FTP command are also affected by this
# option.
use_localtime=YES
#
# Activate logging of uploads/downloads.
xferlog_enable=YES
#
# Make sure PORT transfer connections originate from port 20 (ftp-data).
connect_from_port_20=YES
#
# If you want, you can arrange for uploaded anonymous files to be owned by
# a different user. Note! Using "root" for uploaded files is not
# recommended!
#chown_uploads=YES
#chown_username=whoever
#
# You may override where the log file goes if you like. The default is shown
# below.
#xferlog_file=/var/log/vsftpd.log
#
# If you want, you can have your log file in standard ftpd xferlog format.
# Note that the default log file location is /var/log/xferlog in this case.
#xferlog_std_format=YES
#
# You may change the default value for timing out an idle session.
#idle_session_timeout=600
#
# You may change the default value for timing out a data connection.
#data_connection_timeout=120
#
# It is recommended that you define on your system a unique user which the
# ftp server can use as a totally isolated and unprivileged user.
#nopriv_user=ftpsecure
#
# Enable this and the server will recognise asynchronous ABOR requests. Not
# recommended for security (the code is non-trivial). Not enabling it,
# however, may confuse older FTP clients.
#async_abor_enable=YES
#
# By default the server will pretend to allow ASCII mode ...

[Joshua Powers (powersj)]

Hmm I'm still not getting a reproducer [1]. Are you sure you have restarted your ftp server since you have updated openssl? I am sure you have, but that is the only thing I can think of.

I took your config and just changed the certificates to use mine.

[1] https://paste.ubuntu.com/23865421/

[Rolf Leggewie (r0lf)]

Time to close this one?

[Athos Ribeiro (athos-ribeiro)]

This should had been automatically set to expired. I am re-setting the "incomplete" status here since we did not get a reproducer for this.

It will then eventually be set as expired if we get no reproducer in a while.

[AlainKnaff (kubuntu-misc)]

No longer an issue with testssl.sh version 3.0.8 and vsftpd version 3.0.3-13+b2