[ advisories | exploits | discussions | news | conventions | security tools | texts & papers ]
 main menu
- feedback
- advertising
- privacy
- FightAIDS
- newsletter
- news
 
 discussions
- read forum
- new topic
- search
 

 meetings
- meetings list
- recent additions
- add your info
 
 top 100 sites
- visit top sites
- sign up now
- members
 
 webmasters

- add your url
- add domain
- search box
- link to us

 
 projects
- our projects
- free email
 
 m4d network
- security software
- secureroot
- m4d.com
Home : Advisories : One-byte buffer overrun in ftpd

Title: One-byte buffer overrun in ftpd
Released by: NetBSD
Date: 21st December 2000
Printable version: Click here
-----BEGIN PGP SIGNED MESSAGE-----



                 NetBSD Security Advisory 2000-018

                 =================================



Topic: One-byte buffer overrun in ftpd

Version: All official releases up to and including 1.5

Severity: possible remote root compromise.

Fixed: NetBSD-current: December 4, 2000

NetBSD 1.4 branch: December 14, 2000

NetBSD 1.5 branch: December 13, 2000



Abstract

========



A one-byte buffer overrun was found in the ftp server daemon

(/usr/libexec/ftpd).  It is rumored to be remotely exploitable.



Systems running ftpd are vulnerable.



ftpd is usually started from inetd; inetd is configured through the

/etc/inetd.conf file.



As of the release date of this advisory, all of past NetBSD releases,

including NetBSD 1.5, are vulnerable.



Fresh installs of NetBSD 1.5 are not vulnerable as ftpd is disabled by

default in /etc/inetd.conf; however, a system upgraded from an earlier

release to 1.5 may still be using an old inetd.conf with ftpd still

enabled, or it may need to run and ftp server and will thus have it

enabled.



Technical Details

=================



The replydirname() function is used in ftpd to return pathname strings

to the ftp client.  It contained an erroneous bounds check.



Solutions and Workarounds

=========================



All NetBSD official releases up to 1.5, have a vulnerable ftp server

binary in /usr/libexec/ftpd.  We need to replace it to fix the

problem.



If you do not run ftpd on your system, you system is not vulnerable.  Check

/etc/inetd.conf to see if you have a line starts with "ftp".  We suggest

you to apply the fix anyways, in case you want to run ftpd in the future.

Note that NetBSD 1.5 does not run ftpd by default (inetd.conf has a

commented-out "ftp" line).



Systems running NetBSD-current dated from before December 4, 2000 should be

upgraded to NetBSD-current dated December 4, 2000 or later.



Systems running releases older than NetBSD 1.4 should be upgraded to

NetBSD 1.4.3 before applying the fixes described here.



Systems running NetBSD 1.4.3 should apply the patch contained in



    http://ftp.NetBSD.ORG/pub/NetBSD/misc/security/patches/20001220-ftpd-1.4.3



Systems running NetBSD 1.5 should apply the patch contained in



    http://ftp.NetBSD.ORG/pub/NetBSD/misc/security/patches/20001220-ftpd-1.5



Different patches are needed because the vulnerable function was

moved from ftpd.c to cmds.c.



In the following examples, we assume that you have full source code

under /usr/src, and have stored a copy of the patch in a file named

"20001220-ftpd" in /usr/src/libexec/ftpd



In either case, the patch should be applied in /usr/src/libexec/ftpd

and ftpd should then be rebuilt and reinstalled using the following

commands:



# cd /usr/src/libexec/ftpd

# patch < 20001220-ftpd

# make cleandir

# make depend

# make

# make install



To be sure that the system is no longer vulnerable, you should ensure

that all ftpd processes running on the system started after ftpd was

reinstalled.



Thanks To

=========



Kristian Vlaardingerbroek 





Revision History

================



2000/12/20 - Initial revision





More Information

================



Information about NetBSD and NetBSD security can be found at

http://www.NetBSD.ORG/ and http://www.NetBSD.ORG/Security/.





Copyright 2000, The NetBSD Foundation, Inc.  All Rights Reserved.



$NetBSD: NetBSD-SA2000-018.txt,v 1.1 2000/12/20 18:46:53 sommerfeld Exp $



-----BEGIN PGP SIGNATURE-----

Version: 2.6.3ia

Charset: noconv



iQCVAwUBOkD+5z5Ru2/4N2IFAQFmPQP9E8ShVWoi69PDts+q3KmzyBWNORG4Vu0+

XzK6WP6HwRbHTD4Mj6Zcmv0Ds0He1OeiWi9b+mQ8XJZC/mIjdJLaGyZs/oB/yHhv

MIKKh+vgsTmu+VW2SoxY45A2Y2Qkyoxanqmi206AsIQvr+q5TTH07V6guPUvgs1J

kFsRDbE3OcE=

=TS0t

-----END PGP SIGNATURE-----








(C) 1999-2000 All rights reserved.