A complete revision history can be found at the end of this file.
I. Description
There are two remote code execution vulnerabilities in the Washington University FTP daemon (WU-FTPD). Both of these vulnerabilities have been discussed in public forums and have received widespread exposure.
VU#886083: WU-FTPD does not properly handle file name globbing
WU-FTPD features globbing capabilities that allow a user to specify multiple file names and locations using typical shell notation. See CERT Advisory CA-2001-07 for a more complete explanation of globbing.
WU-FTPD implements its own globbing code instead of using libraries in the underlying operating system. When the globbing code is called, it allocates memory on the heap to store a list of file names that match the expanded glob expression. The globbing code is designed to recognize invalid syntax and return an error condition to the calling function. However, when it encounters a specific string, the globbing code fails to properly return the error condition. Therefore, the calling function proceeds as if the glob syntax were correct and later frees unallocated memory that can contain user-supplied data.
If intruders can place addresses and shellcode in the right locations on the heap using FTP commands, they may be able to cause WU-FTPD to execute arbitrary code by later issuing a command that is mishandled by the globbing code.
This vulnerability is potentially exploitable by any user who is able to log in to a vulnerable server, including users with anonymous access. If the exploit is successful, an attacker may be able to execute arbitrary code with the privileges of WU-FTPD, typically root. If the exploit is unsuccessful, the thread servicing the request will fail, but the WU-FTPD process will continue to run.
Note that at least one derivative of WU-FTPD, BeroFTPD, is also vulnerable. BeroFTPD has been merged back into WU-FTPD and is no longer separately maintained.
This vulnerability has been assigned the identifier CAN-2001-0550 by the Common Vulnerabilities and Exposures (CVE) group:
-
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0550
CORE Security Technologies has published a Vulnerability Report on this issue:
-
http://www.corest.com/pressroom/advisories_desplegado.php?
dxsection=10&idx=17
VU#639760: WU-FTPD configured to use RFC 931 authentication running in debug mode contains format string vulnerability
WU-FTPD can perform RFC 931 authentication when accepting inbound connections from clients. RFC 931 defines the Authentication Server Protocol, and is obsoleted by RFC 1413 which defines the Identity Protocol. RFC 931 is commonly known as "auth" or "authd", and RFC 1413 is commonly known "ident" or "identd". Both are named after the daemon that commonly provides the service.
When using RFC 931 authentication, WU-FTPD will request ident information before authorizing a connection request from a client. The auth or ident service running on the client returns user-specific information, allowing WU-FTPD to make authentication decisions based on data in the ident response.
WU-FTPD can also be run in debugging mode, which provides detailed information about its operation.
When WU-FTPD is configured to perform RFC 931 authentication and is run in debug mode, it logs connection information using syslog(3) function calls. The logging code does not include format string specifiers in some syslog(3) calls, nor does the code perform adequate input validation on the contents of the identd response received from a client. As a result, a crafted identd response containing user-supplied format string specifiers is interpreted by syslog(3), possibly overwriting arbitrary locations in memory. By carefully designing such a request, an attacker may execute arbitrary code with the privileges of WU-FTPD.
This vulnerability is potentially exploitable by any user who is able to log in to a vulnerable server, including users with anonymous access. The intruder must also be able to control their response to the ident request. If successful, an attacker may be able to execute arbitrary code with the privileges of WU-FTPD, typically root.
Note that this vulnerability does not manifest unless WU-FTPD is configured to use RFC 931 authentication and is run in debug mode.
This vulnerability has been assigned the identifier CVE-2001-0187 by the Common Vulnerabilities and Exposures (CVE) group:
-
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0187
III. Solution
Apply patches from your vendor
Appendix A contains information for this advisory provided by vendors. As they report new information to the CERT/CC, we will update this section and note the changes in our revision history. If a particular vendor is not listed below, we have not received their comments. Please contact your vendor directly.
Although some distributions may not include WU-FTPD, it can be compiled and run on a wide variety of UNIX and Linux systems. If you install WU-FTPD separately, apply the source code patches from the WU-FTPD Development Group.
Restrict access to WU-FTPD
As a general practice, the CERT/CC recommends disabling services and access that are not explicitly required. You may wish to disable WU-FTPD until you are able to apply a patch.
If you cannot disable the service, you can limit your exposure to these vulnerabilities by blocking or restricting access to the control channel (by default, port 21/tcp) used by WU-FTPD. In the case of the format string vulnerability (VU#639760), an exploit would be transmitted from port 113/tcp on the attacking host to the WU-FTPD server that made the identd request. Note that blocking access from untrusted networks such as the Internet does not protect your systems against attacks from within your network.
Disable anonymous FTP access
Although disabling anonymous FTP access does not prevent attacks from occurring, it does prevent unauthenticated users from attempting to exploit the globbing vulnerability (VU#886083).
CERT/CC personnel answer the hotline 08:00-17:00 EST(GMT-5) / EDT(GMT-4)
Monday through Friday; they are on call for emergencies during other
hours, on U.S. holidays, and on weekends.
We strongly urge you to encrypt sensitive information sent by
email. Our public PGP key is available from
CERT publications and other security information are available from
our web site
* "CERT" and "CERT Coordination Center" are registered in the U.S. Patent and Trademark Office.
Copyright 2002 Carnegie Mellon University.
