On Sun, Jul 04, 1999 at 01:38:48PM +0200, Michal Zalewski wrote:
> ----------------------------
> wu-ftpd 2.5, VR and BeroFTPD
> ----------------------------
>
> Compromise: remote root
>
> Solution: add strlen() check somewhere
>
> There's an overflow in wu-ftpd 2.5 and prior releases (including VR and
> BeroFTPD) in mapped_path when mapping current working directory to
> command-line. While I discovered this vunerability by myself, I don't want
> to provide exploit code, as all other, hard work has been done
> independently by someone else. Instead of that, there's a .diff file with
> patch, attached somewhere as ftpd.diff.
The Debian package of wu-ftpd (2.5.0-3) has just been updated with this
patch:
--- wu-ftpd-2.5.0.orig/src/ftpd.c
+++ wu-ftpd-2.5.0/src/ftpd.c
@@ -1243,9 +1246,12 @@
}
/* append the dir part with a leading / unless at root */
- if( !(mapped_path[0] == '/' && mapped_path[1] == '\0') )
- strcat( mapped_path, "/" );
- strcat( mapped_path, dir );
+ if ( strlen( mapped_path ) + strlen( dir ) < MAXPATHLEN-2 ) {
+ if( !(mapped_path[0] == '/' && mapped_path[1] == '\0') )
+ strcat( mapped_path, "/" );
+ strcat( mapped_path, dir );
+ } else
+ syslog( LOG_ERR, "mapped_path overflow: possible exploit attempt" );
}
int
Correct me if I'm wrong, but it doesn't seem that the wu-ftpd Academ betas
(specifically beta 16, included in Debian 2.1 (slink)) are vulnerable.
Thus I doubt that our security team will issue an advisory, because this
version is present only in the unstable distribution.
--
enJoy -*/\*- don't even try to pronounce my first name
This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 14:58:54 PDT