Versions Affected : All versions prior to TrueNAS 12.0-U6

---

Description

The passive mode in FTP communication allows an out of boundary read while libfetch uses strtol to parse the relevant numbers into address bytes.

It does not check if the line ends prematurely. If it does, the for-loop condition checks for *p == ‘\0’ one byte too late because p++ was already performed.

---

Workaround

No workaround is available.

---

Mitigation

• Upgrade to TrueNAS 12.0-U6 or later.

---

Commit

• FreeBSD Revision : r370395
• TrueNAS Commit : fe9da4c
• TrueNAS Commit : f4242bd
• JIRA Ticket : NAS-111999

---

Further information

• FreeBSD Errata Notice Entry