[ Search ]
[ What's New? ]
[ About ]
|
|
| wu.ftpd(8) | |
|---|---|
| Systems Affected: | Sites running wuarchive ftpd versions prior to 2.3 or running "wrl" ftpd version ?? |
| Problem: | wu-ftpd before version 2.3 has a bug in the "SITE EXEC" command which allows people to run commands in the ftp server. If the directory /bin/ftp-exec exits *inside* the anonymous ftp chroot area, the attack is fairly weak - you can get a shell owned inside the ftp area. This is still a pretty nasty attack since there is a change you could use it to upload trojans to the ftp server. However if you have a /bin/ftp-exec directory in your real outside filesystem, a hacker can trivially get a root shell on your machine by telneting to the ftp port and issuing a SITE EXEC ../../../../bin/sh command! - you issue this command as the first thing you do after telneting to the port, before any attempt to log in. Thus you still have the root privileges of the ftp deamon itself. Nasty. |
| Solution: | As an emergency measure remove the ftp-exec directory immediately, hack the source and remove the 'site exec' feature, add 'chmod no anonymous' and 'umask no anonymous' to your ftpaccess file to stop outsiders from uploading executables, then as soon as you possible can, fetch the latest version of wuarchive's ftpd. Upgrade to the lastest version. |
|
Aleph One / aleph1@underground.org Copyright © 1996 Computer Underground Society. All rights reserved. |
|