 |
|
 |
CERT® Advisory CA-1995-16 wu-ftpd Misconfiguration VulnerabilityOriginal issue date: November 30, 1995Last revised: September 23, 1997 Updated copyright statement A complete revision history is at the end of this file. A vulnerability exists with certain configurations of the SITE EXEC command in the Washington University ftpd, also known as wu-ftpd. Exploitation of this vulnerability may allow root access from any account on the system. The vulnerable configuration is known to exist in numerous Linux distributions and is currently being actively exploited by intruders. It should be noted that this vulnerability is not necessarily limited to Linux but may exist on any wu-ftpd installation. Thus, all users of the wu-ftpd program, not just the Linux users, should take this opportunity to verify the configuration of their daemons. Note that versions of wu-ftpd before the 2.4 release contain serious security vulnerabilities and should be updated immediately. Section III contains instructions for disabling ftpd and correcting the configuration. We will update this advisory as we receive additional information. Please check advisory files regularly for updates that relate to your site.
I. DescriptionThere is a problem with the default configuration of the Washington University FTP Server version 2.4 in major Linux distributions, including but not limited to Slackware 2.0, 2.1, 2.2, 2.3, Yggdrasil Plug&Play Fall'94, and the Debian Distribution. By exploiting this problem, any user who is able to log into a system having the vulnerable configuration via FTP using their login, and not the anonymous login, may gain root access. Other systems besides Linux can be configured to be vulnerable although the standard wu-ftpd 2.4 source code as distributed is not vulnerable. The problem is that the variable _PATH_EXECPATH was set to "/bin" in the configuration file src/pathnames.h when the distribution binary was built. _PATH_EXECPATH should be set to "/bin/ftp-exec" or a similar directory that does not contain a shell or command interpreter, for example. The source code shipped with the Linux distributions contains the correct value ("/bin/ftp-exec") despite the incorrect distribution binary. You should verify that _PATH_EXECPATH has the correct value before recompiling. Note that the documentation for wu-ftpd states that the directory defined by _PATH_EXECPATH is relative to ~ftp, the ftp home directory as specified in the password file. This is misleading. The pathname is relative to ~ftp for anonymous users only. This pathname is relative to "/" for other user sessions.
II. ImpactAny user with a local account on a system offering FTP services with the vulnerable configuration may gain root access. Support for anonymous FTP access is not required to exploit this vulnerability.
III. How to determine if you are vulnerableAll systems running wu-ftpd should be checked to determine if the configuration is vulnerable. To test your configuration, access the FTP server using a legitimate user account (not an anonymous FTP login) and login to your FTP server. For example:
srchost> ftp ftphost
Connected to ftphost
220 ftphost FTP server (Version wu-2.4(2) Mon Apr 18 09:135 [...]
ready.
Name (srchost:joe):
331 Password required for joe.
Password:
230 User joe logged in.
Then type:
ftp> quote site exec echo problem
If you see the following response, then you are not vulnerable:
200-echo problem
200 (end of 'echo problem')
However, if you see this following response, then you are vulnerable (note the additional '200-problem' entry):
200-echo problem
200-problem
200 (end of 'echo problem')
IV. SolutionIf you have the vulnerability, we recommend that you turn off ftpd immediately using the method described in Section A below. Once you have done that, you can then decide whether to rebuild or fetch a new ftpd binary. If you have built wu-ftpd from a source distribution, follow the steps in Sections B.2 and B.3 below. Once you have eliminated this vulnerability, turn on ftpd with the method described in Section C below.
A. Disable ftpdTo disable ftpd, do the following as root.
B. Correct the configurationItem 1 below applies to those running Debian Linux. Item 2 applies to all other Linux systems. Item 3 applies to those who are building wu-ftpd from source on systems other than Linux.
C. Enabling ftpd
IV. Advice on configuring the FTP Daemon for SITE EXECHere are some configuration guidelines for the directories named by the _PATH_EXECPATH variable.
The CERT Coordination Center thanks AUSCERT, the Australian response team, and Alexander O. Yuriev, Temple University, author of Linux Security Updates, for their support in responding to this problem. Linux Security Updates are available from http://bach.cis.temple.edu/linux/linux-security/
UPDATES
Information for Solaris 2.4After the advisory was originally issued, Charles Jardine <cj10@cam.ac.uk> provided the following information. The problem with the SITE EXEC command is that programs spawned by wu-ftpd are run as the effective user and group id of the logged in user but real user and group id of root (or however wu-ftpd is started by inetd, usually root). To address this, the following can be used as a basis for a patch. (Note that this patch works for Solaris 2.4 compiled with gcc-2.7.2.)
*** /tmp/T0a001YI Mon Dec 4 10:22:13 1995
--- popen.c Mon Dec 4 10:22:08 1995
***************
*** 141,146 ****
--- 141,158 ----
}
(void) close(pdes[1]);
}
+ /*
+ * This fixes the ``real'' problem with SITE EXEC
+ */
+ {
+ uid_t u = geteuid();
+ gid_t g = getegid();
+
+ setuid(0);
+ setgid(g);
+ setuid(u);
+ }
+
execv(gargv[0], gargv);
_exit(1);
}
This document is available from: http://www.cert.org/advisories/CA-1995-16.html CERT/CC Contact Information
Phone: +1 412-268-7090 (24-hour hotline) Fax: +1 412-268-6989 Postal address: CERT/CC personnel answer the hotline 08:00-17:00 EST(GMT-5) / EDT(GMT-4) Monday through Friday; they are on call for emergencies during other hours, on U.S. holidays, and on weekends. Using encryptionWe strongly urge you to encrypt sensitive information sent by email. Our public PGP key is available from If you prefer to use DES, please call the CERT hotline for more information. Getting security informationCERT publications and other security information are available from our web site
* "CERT" and "CERT Coordination Center" are registered in the U.S. Patent and Trademark Office.
NO WARRANTY Conditions for use, disclaimers, and sponsorship information
Copyright 1995, 1996 Carnegie Mellon University. Revision History
Sep. 23, 1997 Updated copyright statement
Aug. 30, 1996 Information previously in the README was inserted
into the advisory.
Jan. 19, 1996 Updates - Added code that can be used as the basis for a patch
for the SITE EXEC command for Solaris 2.4.
Dec. 19, 1995 Sec. III - Expanded the explanation of how to determine if
you are vulnerable.
|
