=============================================================================== Security Advisory CERT-NL =============================================================================== Author/Source : CERT-NL (Erik-Jan Bos) Index : S-94-10 Distribution : World Page : 1 Classification: External Version: Final Subject : ftpd Vulnerabilities Date : 15-Apr-94 =============================================================================== CERT-NL has received information concerning two vulnerabilities in some ftpd implementations. The first is a vulnerability with the SITE EXEC command feature of the FTP daemon (ftpd) found in versions of ftpd that support the SITE EXEC feature. This vulnerability allows local or remote users to gain root access. The second vulnerability involves a race condition found in the ftpd implementations listed in Section I. below. This vulnerability allows local users to gain root access. Sites using these implementations are vulnerable even if they do not support anonymous FTP. As these vulnerabilities are widely known, we strongly recommend that any site running a version of ftpd listed below take steps to immediately upgrade or disable their FTP daemon. Also potentially at risk are sites whose ftpd is derived from the DECWRL or wuarchive ftpd code containing the SITE EXEC feature. For additional information or assistance, contact the developer or vendor of your ftpd implementation. If we receive additional information relating to this advisory, we will place it, along with any clarifications, in a README file available by anonymous FTP from info.cert.org (e.g., /pub/cert_advisories/CA-94:xx.README). We encourage you to check our README files regularly for updates on advisories that relate to your site. ----------------------------------------------------------------------------- I. Description There is a vulnerability in the SITE EXEC command feature of ftpd that allows any remote or local user to obtain root access. There is also a vulnerability due to a race condition in these implementations. Versions known to be vulnerable to these problems are: wuarchive ftpd versions 2.0-2.3 (version 2.2 patched the SITE EXEC problem, but not the race condition) DECWRL ftpd versions prior 5.93 BSDI ftpd version 1.1 prior to patch 5 The SITE EXEC vulnerability affects your ftpd only if the SITE EXEC command feature has been explicitly activated at your site. This functionality is not activated by default. Sites that have not enabled the SITE EXEC feature are not at risk from this vulnerability. However, since the race condition does not have an easily applied workaround, CERT recommends that you upgrade to one of the versions listed below. II. Impact Anyone (remote or local) can gain root access on a host running a vulnerable FTP daemon. Support for anonymous FTP is not required to exploit this vulnerability. III. Solution Affected sites can solve both of these problems by upgrading to the latest version of ftpd. These versions are listed below. Be certain to verify the checksum information to confirm that you have retrieved a valid copy. If you cannot install the new version in a timely manner, you should disable FTP service until you have corrected this problem. It is not sufficient to disable anonymous FTP. You must disable the FTP daemon. For wuarchive ftpd, you can obtain version 2.4 via anonymous FTP from wuarchive.wustl.edu, in the "/packages/wuarchive-ftpd" directory. If you are currently running version 2.3, a patch file is available. BSD SVR4 File Checksum Checksum MD5 Digital Signature ----------------- -------- --------- -------------------------------- wu-ftpd-2.4.tar.Z 38213 181 20337 362 cdcb237b71082fa23706429134d8c32e patch_2.3-2.4.Z 09291 8 51092 16 5558a04d9da7cdb1113b158aff89be8f For DECWRL ftpd, sites can obtain version 5.93 via anonymous FTP from gatekeeper.dec.com in the "/pub/misc/vixie" directory. BSD SVR4 File Checksum Checksum MD5 Digital Signature ----------------- -------- --------- -------------------------------- ftpd.tar.gz 38443 60 1710 119 ae624eb607b4ee90e318b857e6573500 For BSDI systems, patch 005 should be applied to version 1.1 of the BSD/386 software. You can obtain the patch file via anonymous FTP from ftp.bsdi.com in the "/bsdi/patches-1.1" directory. BSD SVR4 File Checksum Checksum MD5 Digital Signature ----------------- -------- --------- -------------------------------- BU110-005 35337 272 54935 543 1f454d4d9d3e1397d1eff0432bd383cf --------------------------------------------------------------------------- The CERT Coordination Center wishes to thank Neil Woods and Karl Strickland for finding and reporting the wustl FTP daemon bug. We also wish to thank Bryan O'Connor and Chris Myers of Washington University in St. Louis, Paul Vixie of Vixie Enterprises, and Tony Sanders of BSDI for their invaluable assistance in resolving this problem. --------------------------------------------------------------------------- CERT-NL wishes to thank The CERT Coordination Center for bringing this information to our attention. ============================================================================== CERT-NL is the Computer Emergency Response Team, located in The Netherlands. CERT-NL is a Full Member of the Forum of Incident Response and Security Teams (FIRST). The constituency of CERT-NL are the SURFnet connected institutions. Past CERT-NL Security Bulletins and other CERT-NL related material can be found on the anonymous FTP server of SURFnet bv: "ftp.nic.surfnet.nl" [192.87.46.3], in the directory "surfnet/net-security/cert-nl/docs/bulletin". This information is also available using email. Send an email saying "help" to "mailserv@nic.surfnet.nl". In case of computer or network security problems please contact CERT-NL or the CERT of your own constituency. Please be aware of the fact that we are one (when DST is in effect two) hour(s) ahead of Universal Time Coordinated (i.e. UTC+0100 (UTC+0200)). Email: cert-nl@surfnet.nl Phone: +31 30 310290 Fax: +31 30 340903 Snailmail: SURFnet bv Attn. CERT-NL P.O. Box 19035 NL - 3501 DA UTRECHT The Netherlands A 7 * 24 hours phone number is available to SURFnet SSC's and FIRST members on request. ============================================================================== --- End of Advisory __ Erik-Jan.