wu-ftpd /bin SITE EXEC Misconfiguration Vulnerability
BID:2241
Info
wu-ftpd /bin SITE EXEC Misconfiguration Vulnerability
| Bugtraq ID: | 2241 |
| Class: | Configuration Error |
| CVE: | |
| Remote: | Yes |
| Local: | Yes |
| Published: | Nov 30 1995 12:00AM |
| Updated: | Nov 30 1995 12:00AM |
| Credit: | Revealed by Olaf Kirch <[email protected]> in a message dated May 31, 1995. |
| Vulnerable: |
Washington University wu-ftpd 2.4.1 |
| Not Vulnerable: |
Washington University wu-ftpd 2.6 .0 Washington University wu-ftpd 2.5 .0 Washington University wu-ftpd 2.4.2 academ[BETA1-15] Washington University wu-ftpd 2.4.2 academ[BETA-18] Washington University wu-ftpd 2.4.2 (beta 18) VR4 |
Discussion
wu-ftpd /bin SITE EXEC Misconfiguration Vulnerability
Due to a misconfiguration in the configuration file pathnames.h, some distributed binaries of wuftp version 2.4.1 and earlier allow an attacker with an FTP account on the system to gain root access. This is accomplished by running the "site exec" command. The problem lies in the fact that pathnames.h erroneously set _PATH_EXECPATH to /bin - this pathname is relative to ~ftp for anonymous users, but for users with accounts it is relative to / and therefore specifies the real /bin rather than ~ftp/bin. If SITE EXEC is enabled, the user can gain root access by running a shell or other command using site exec.
Due to a misconfiguration in the configuration file pathnames.h, some distributed binaries of wuftp version 2.4.1 and earlier allow an attacker with an FTP account on the system to gain root access. This is accomplished by running the "site exec" command. The problem lies in the fact that pathnames.h erroneously set _PATH_EXECPATH to /bin - this pathname is relative to ~ftp for anonymous users, but for users with accounts it is relative to / and therefore specifies the real /bin rather than ~ftp/bin. If SITE EXEC is enabled, the user can gain root access by running a shell or other command using site exec.
Exploit / POC
wu-ftpd /bin SITE EXEC Misconfiguration Vulnerability
To find out if your machine is affected, ftp to your own account, log in
and enter this: quote "site exec bash -c id". If ftpd responds with
a line that says something like "uid=0(root) euid=1234(your_login)... ",
then your ftpd is vulnerable.
To find out if your machine is affected, ftp to your own account, log in
and enter this: quote "site exec bash -c id". If ftpd responds with
a line that says something like "uid=0(root) euid=1234(your_login)... ",
then your ftpd is vulnerable.
Solution / Fix
wu-ftpd /bin SITE EXEC Misconfiguration Vulnerability
Solution:
Upgrade to a newer version of wuftp
Solution:
Upgrade to a newer version of wuftp
References
wu-ftpd /bin SITE EXEC Misconfiguration Vulnerability
References:
References: