SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (File Transfer/Sharing)  >   Wu-ftpd Vendors:   WU-FTPD Development Group
wu-ftpd S/Key Challenge Buffer Overflow Lets Remote Users Execute Arbitrary Code With Root Privileges
SecurityTracker Alert ID:  1009316
SecurityTracker URL:  http://securitytracker.com/id/1009316
CVE Reference:   CVE-2004-0185   (Links to External Site)
Date:  Mar 4 2004
Impact:   Execution of arbitrary code via network, Root access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 2.6.2 and possibly earlier versions
Description:   A stack overflow vulnerability was reported in wu-ftpd when S/Key support is enabled. A remote user can execute arbitrary code on the target system with root privileges.

In October 2003, Michael Hendrickx reported that a remote user can supply specially crafted authentication credentials to trigger the overflow and cause the wu-ftpd daemon to crash or execute arbitrary code. The code will run with root privileges, according to the report.

The flaw is due to a sprintf() overflow of a static buffer in the skey_challenge() function in 'src/ftpd.c', where the length of the user-supplied '*name' variable is not validated.

Impact:   A remote user can execute arbitrary code with root privileges on the target system.
Solution:   The vendor has released a patch for version 2.6.2, available at:

ftp://ftp.wu-ftpd.org/pub/wu-ftpd/patches/apply_to_2.6.2/skeychallenge.patch

Vendor URL:  www.wuftpd.org/ (Links to External Site)
Cause:   Boundary error
Underlying OS:  Linux (Any), UNIX (Any)

Message History:   This archive entry has one or more follow-up message(s) listed below.
Mar 9 2004 (Debian Issues Fix) wu-ftpd S/Key Challenge Buffer Overflow Lets Remote Users Execute Arbitrary Code With Root Privileges
Debian has released a fix.
Apr 9 2004 (HP Issues Fix for Tru64) wu-ftpd S/Key Challenge Buffer Overflow Lets Remote Users Execute Arbitrary Code With Root Privileges
HP has issued an Early Release Patch for Tru64 UNIX 5.1A and 5.1B.



 Source Message Contents

Subject:  http://unixpunx.org/txt/exploits_archive/packetstorm/0310-advisories/wuftpd-skey.txt


http://unixpunx.org/txt/exploits_archive/packetstorm/0310-advisories/wuftpd-skey.txt

  wuftpd v2.6.2 skey stack overflow vulnerability
  by <michael@scanit.be>

  --------------------------------------------------------------------------

  Affected:     Washington University FTP deamon, version 2.6.2 and
                possibly below (not tested), with SKEY support enabled.

  Not affected: NetBSD machines running wu-ftpd

  Impact:  Severe (remote code execution) if skey support is enabled.


  General:
  --------

  The Washington University FTP deamon (hereafter reffered to as "wuftpd") is
  a replacement FTP server for POSIX systems.  Wuftpd supports skey
  authentication to provide secure logins.  However, the code that 'handles'
  this has an exploitable stack based buffer overflow.   Providing specially
  crafted authentication credentials, it is possible to crash the deamon or
  execute user-supplied code, running with root privileges.


  Technical details:
  ------------------

  A statically allocated buffer is filled using the sprintf() function in the
  skey_challenge() function (src/ftpd.c).

  char *skey_challenge(char *name, struct passwd *pwd, int pwok)
  {
      static char buf[128];
      ...
      if (pwd == NULL || skeychallenge(&skey, pwd->pw_name, sbuf))
          sprintf(buf, "Password required for %s.", name);
      else
	 sprintf(buf, "%s %s for %s.", sbuf,
		 pwok ? "allowed" : "required", name);
      return (buf);
  }

  The variable *name is never subject to any boundries checking.

  It is possible to write beyond the buf[] array, overwriting the return address
  of the function, modifying the path of execution flow.


  Fix/Workaround:
  ---------------

  To protect you from this vulnerability, disable skey support, or apply
  the following patch:

  --- ftpd.c      2001-11-29 17:56:11.000000000 +0100
  +++ ftpd.c        2003-10-20 20:43:58.000000000 +0200
  @@ -1662,9 +1662,9 @@
       /* Display s/key challenge where appropriate. */

       if (pwd == NULL || skeychallenge(&skey, pwd->pw_name, sbuf))
  -       sprintf(buf, "Password required for %s.", name);
  +       snprintf(buf, 128-1, "Password required for %s.", name);
       else
  -       sprintf(buf, "%s %s for %s.", sbuf,
  +       snprintf(buf, 128-1, "%s %s for %s.", sbuf,
                  pwok ? "allowed" : "required", name);
       return (buf);
   }


  This information has been provided by Michael Hendrickx <michael@scanit.be>


 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC