Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2000.404 -- NetBSD Security Advisory 2000-018
One-byte buffer overrun in ftpd
22 December 2000
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: ftpd
Vendor: NetBSD
Operating System: NetBSD
OpenBSD
Impact: Root Compromise
Access Required: Remote
Ref: ESB-2000.402
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
NetBSD Security Advisory 2000-018
=================================
Topic: One-byte buffer overrun in ftpd
Version: All official releases up to and including 1.5
Severity: possible remote root compromise.
Fixed: NetBSD-current: December 4, 2000
NetBSD 1.4 branch: December 14, 2000
NetBSD 1.5 branch: December 13, 2000
Abstract
========
A one-byte buffer overrun was found in the ftp server daemon
(/usr/libexec/ftpd). It is rumored to be remotely exploitable.
Systems running ftpd are vulnerable.
ftpd is usually started from inetd; inetd is configured through the
/etc/inetd.conf file.
As of the release date of this advisory, all of past NetBSD releases,
including NetBSD 1.5, are vulnerable.
Fresh installs of NetBSD 1.5 are not vulnerable as ftpd is disabled by
default in /etc/inetd.conf; however, a system upgraded from an earlier
release to 1.5 may still be using an old inetd.conf with ftpd still
enabled, or it may need to run and ftp server and will thus have it
enabled.
Technical Details
=================
The replydirname() function is used in ftpd to return pathname strings
to the ftp client. It contained an erroneous bounds check.
Solutions and Workarounds
=========================
All NetBSD official releases up to 1.5, have a vulnerable ftp server
binary in /usr/libexec/ftpd. We need to replace it to fix the
problem.
If you do not run ftpd on your system, you system is not vulnerable. Check
/etc/inetd.conf to see if you have a line starts with "ftp". We suggest
you to apply the fix anyways, in case you want to run ftpd in the future.
Note that NetBSD 1.5 does not run ftpd by default (inetd.conf has a
commented-out "ftp" line).
Systems running NetBSD-current dated from before December 4, 2000 should be
upgraded to NetBSD-current dated December 4, 2000 or later.
Systems running releases older than NetBSD 1.4 should be upgraded to
NetBSD 1.4.3 before applying the fixes described here.
Systems running NetBSD 1.4.3 should apply the patch contained in
ftp://ftp.NetBSD.ORG/pub/NetBSD/misc/security/patches/20001220-ftpd-1.4.3
Systems running NetBSD 1.5 should apply the patch contained in
ftp://ftp.NetBSD.ORG/pub/NetBSD/misc/security/patches/20001220-ftpd-1.5
Different patches are needed because the vulnerable function was
moved from ftpd.c to cmds.c.
In the following examples, we assume that you have full source code
under /usr/src, and have stored a copy of the patch in a file named
"20001220-ftpd" in /usr/src/libexec/ftpd
In either case, the patch should be applied in /usr/src/libexec/ftpd
and ftpd should then be rebuilt and reinstalled using the following
commands:
# cd /usr/src/libexec/ftpd
# patch < 20001220-ftpd
# make cleandir
# make depend
# make
# make install
To be sure that the system is no longer vulnerable, you should ensure
that all ftpd processes running on the system started after ftpd was
reinstalled.
Thanks To
=========
Kristian Vlaardingerbroek <kris@obit.nl>
Revision History
================
2000/12/20 - Initial revision
More Information
================
Information about NetBSD and NetBSD security can be found at
http://www.NetBSD.ORG/ and http://www.NetBSD.ORG/Security/.
Copyright 2000, The NetBSD Foundation, Inc. All Rights Reserved.
$NetBSD: NetBSD-SA2000-018.txt,v 1.1 2000/12/20 18:46:53 sommerfeld Exp $
- -----BEGIN PGP SIGNATURE-----
Version: 2.6.3ia
Charset: noconv
iQCVAwUBOkD+5z5Ru2/4N2IFAQFmPQP9E8ShVWoi69PDts+q3KmzyBWNORG4Vu0+
XzK6WP6HwRbHTD4Mj6Zcmv0Ds0He1OeiWi9b+mQ8XJZC/mIjdJLaGyZs/oB/yHhv
MIKKh+vgsTmu+VW2SoxY45A2Y2Qkyoxanqmi206AsIQvr+q5TTH07V6guPUvgs1J
kFsRDbE3OcE=
=TS0t
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to use any or all of this information is
the responsibility of each user or organisation, and should be done so in
accordance with site policies and procedures.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the original authors to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/Information/advisories.html
If you believe that your system has been compromised, contact AusCERT or
your representative in FIRST (Forum of Incident Response and Security
Teams).
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for emergencies.
-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv
Comment: ftp://ftp.auscert.org.au/pub/auscert/AUSCERT_PGP.key
iQCVAwUBOlSNdCh9+71yA2DNAQGg8AP/TB2py19Jiy1pG0H6MhKdplldCpg90Vcm
3WbnXMV3WgMtuKcfdxwlm9iunHHomh/AiksmAbQs/i1ibD/PuDCMFgdxUrKzPcA/
z0Z72+XCg1IHXY3YzwMWmlKccvQ7W/vhZT4aYSJPch8HTPmc1+FxO18LEnCD4qyy
649gB1RCmBM=
=WCc5
-----END PGP SIGNATURE-----