Multiple Vendor FTP pipe Vulnerability

BID:396

Info

Multiple Vendor FTP pipe Vulnerability

Bugtraq ID: 396
Class: Input Validation Error
CVE:
Remote: Yes
Local: No
Published: Oct 29 1997 12:00AM
Updated: Oct 29 1997 12:00AM
Credit: This was initially published by the IBM ERS Team as ERS-SVA-E01-1997:009.1 on 29 October 1997. Folluwup posts by Bugtraq readers showed multiple other vendors to be vulnerable to the same attack.
Vulnerable: Sun SunOS 4.1.4
Sun SunOS 4.1.3 c
Sun SunOS 4.1.3 _U1
Sun Solaris 2.5.1 _x86
Sun Solaris 2.5.1 _ppc
Sun Solaris 2.5.1
Sun Solaris 2.6_x86
Sun Solaris 2.6
Sun Solaris 2.5_x86
Sun Solaris 2.5
Sun Solaris 2.4_x86
Sun Solaris 2.4
Sun Solaris 2.3
Redhat Linux 8.0 i386
Redhat Linux 7.3 i386
Redhat Linux 7.2 ia64
Redhat Linux 7.2 i386
Redhat Linux 7.1 i386
Redhat Linux 7.0 i386
Redhat Linux 6.2 i386
Redhat krb5-workstation-1.2.5-6.i386.rpm
+ Redhat Linux 8.0
Redhat krb5-workstation-1.2.4-1.i386.rpm
+ Redhat Linux 7.3
Redhat krb5-workstation-1.2.2-13.i386.rpm
+ Redhat Linux 7.2
Redhat krb5-workstation-1.2.1-8.i386.rpm
+ Redhat Linux 7.0
Redhat krb5-workstation-1.1.1-9.i386.rpm
+ Redhat Linux 6.2
 Redhat krb5-server-1.2.5-6.i386.rpm
+ Redhat Linux 8.0
Redhat krb5-server-1.2.4-1.i386.rpm
+ Redhat Linux 7.3
Redhat krb5-server-1.2.2-13.i386.rpm
+ Redhat Linux 7.2
Redhat krb5-server-1.2.1-8.i386.rpm
+ Redhat Linux 7.0
Redhat krb5-server-1.1.1-9.i386.rpm
+ Redhat Linux 6.2
 Redhat krb5-libs-1.2.5-6.i386.rpm
+ Redhat Linux 8.0
Redhat krb5-libs-1.2.4-1.i386.rpm
+ Redhat Linux 7.3
Redhat krb5-libs-1.2.2-13.i386.rpm
+ Redhat Linux 7.2
Redhat krb5-libs-1.2.1-8.i386.rpm
+ Redhat Linux 7.0
Redhat krb5-libs-1.1.1-9.i386.rpm
+ Redhat Linux 6.2
 Redhat krb5-devel-1.2.5-6.i386.rpm
+ Redhat Linux 8.0
Redhat krb5-devel-1.2.4-1.i386.rpm
+ Redhat Linux 7.3
Redhat krb5-devel-1.2.2-13.i386.rpm
+ Redhat Linux 7.2
Redhat krb5-devel-1.2.1-8.i386.rpm
+ Redhat Linux 7.0
Redhat krb5-devel-1.1.1-9.i386.rpm
+ Redhat Linux 6.2
 Redhat krb5-configs-1.1.1-9.i386.rpm
+ Redhat Linux 6.2
 MIT Kerberos FTP Client
Microsoft Windows 2000 Server SP3
Microsoft Windows 2000 Server SP2
Microsoft Windows 2000 Server SP1
Microsoft Windows 2000 Server
+ Avaya DefinityOne Media Servers
+ Avaya IP600 Media Servers
+ Avaya S3400 Message Application Server 0
 + Avaya S8100 Media Servers 0
 Microsoft Windows 2000 Professional SP3
Microsoft Windows 2000 Professional SP2
Microsoft Windows 2000 Professional SP1
Microsoft Windows 2000 Professional
Microsoft Windows 2000 Datacenter Server SP3
Microsoft Windows 2000 Datacenter Server SP2
Microsoft Windows 2000 Datacenter Server SP1
Microsoft Windows 2000 Datacenter Server
Microsoft Windows 2000 Advanced Server SP3
Microsoft Windows 2000 Advanced Server SP2
Microsoft Windows 2000 Advanced Server SP1
Microsoft Windows 2000 Advanced Server
IBM AIX 4.2.1
IBM AIX 4.2
IBM AIX 4.1.5
IBM AIX 4.1.4
IBM AIX 4.1.3
IBM AIX 4.1.2
IBM AIX 4.1.1
IBM AIX 4.1
IBM AIX 3.2.5
IBM AIX 3.2.4
IBM AIX 3.2
HP HP-UX (VVOS) 10.24
HP HP-UX 11.22
HP HP-UX 11.11
HP HP-UX 11.0 4
HP HP-UX 11.0
HP HP-UX 10.20
HP HP-UX 10.16
HP HP-UX 10.10
HP HP-UX 10.0
HP HP-UX 9.10
HP HP-UX 9.9
HP HP-UX 9.8
HP HP-UX 9.7
HP HP-UX 9.6
HP HP-UX 9.5
HP HP-UX 9.4
HP HP-UX 9.3
HP HP-UX 9.1
HP HP-UX 9.0
Caldera UnixWare 7.1.3
Caldera UnixWare 7.1.1
Caldera OpenUnix 8.0
Not Vulnerable: Sun Solaris 7.0_x86
Sun Solaris 7.0
Netscape Communicator 4.51
- Caldera OpenLinux Desktop 2.3
- Caldera OpenLinux eBuilder 3.0
- Microsoft Windows 2000 Professional
- Microsoft Windows 95
- Microsoft Windows 98
- Microsoft Windows NT 4.0
 - Redhat Linux 6.2 sparc
 - Redhat Linux 6.2 i386
 - Redhat Linux 6.2 alpha
 - Redhat Linux 6.1 sparc
 - Redhat Linux 6.1 i386
 - Redhat Linux 6.1 alpha
 - Redhat Linux 6.0 sparc
 - Redhat Linux 6.0 alpha
 - Redhat Linux 6.0
- Redhat Linux 5.2 sparc
 - Redhat Linux 5.2 i386
 - Redhat Linux 5.2 alpha
 - SCO eDesktop 2.4
- SCO eServer 2.3
- SuSE Linux 7.0
Netscape Communicator 4.6
- Caldera OpenLinux Desktop 2.3
- Caldera OpenLinux eBuilder 3.0
- Microsoft Windows 2000 Professional
- Microsoft Windows 95
- Microsoft Windows 98
- Microsoft Windows NT 4.0
 - Redhat Linux 6.2 sparc
 - Redhat Linux 6.2 i386
 - Redhat Linux 6.2 alpha
 - Redhat Linux 6.1 sparc
 - Redhat Linux 6.1 i386
 - Redhat Linux 6.1 alpha
 - Redhat Linux 6.0 sparc
 - Redhat Linux 6.0 alpha
 - Redhat Linux 6.0
- Redhat Linux 5.2 sparc
 - Redhat Linux 5.2 i386
 - Redhat Linux 5.2 alpha
 - SCO eDesktop 2.4
- SCO eServer 2.3
- SuSE Linux 7.0
Netscape Communicator 4.5 BETA
Netscape Communicator 4.5
- Caldera OpenLinux Desktop 2.3
- Caldera OpenLinux eBuilder 3.0
- Mandriva Linux Mandrake 7.1
- Mandriva Linux Mandrake 7.0
- Mandriva Linux Mandrake 6.1
- Mandriva Linux Mandrake 6.0
- Microsoft Windows 2000 Professional
- Microsoft Windows 95
- Microsoft Windows 98
- Microsoft Windows NT 4.0
 - Redhat Linux 6.2 sparc
 - Redhat Linux 6.2 i386
 - Redhat Linux 6.2 alpha
 - Redhat Linux 6.1 sparc
 - Redhat Linux 6.1 i386
 - Redhat Linux 6.1 alpha
 - Redhat Linux 6.0 sparc
 - Redhat Linux 6.0 alpha
 - Redhat Linux 6.0
- Redhat Linux 5.2 sparc
 - Redhat Linux 5.2 i386
 - Redhat Linux 5.2 alpha
 - SCO eDesktop 2.4
- SCO eServer 2.3
- SuSE Linux 7.0
Netscape Communicator 4.0
- Caldera OpenLinux Desktop 2.3
- Caldera OpenLinux eBuilder 3.0
- Mandriva Linux Mandrake 7.1
- Mandriva Linux Mandrake 7.0
- Mandriva Linux Mandrake 6.1
- Mandriva Linux Mandrake 6.0
- Microsoft Windows 2000 Professional
- Microsoft Windows 95
- Microsoft Windows 98
- Microsoft Windows NT 4.0
 - Redhat Linux 6.2 sparc
 - Redhat Linux 6.2 i386
 - Redhat Linux 6.2 alpha
 - Redhat Linux 6.1 sparc
 - Redhat Linux 6.1 i386
 - Redhat Linux 6.1 alpha
 - Redhat Linux 6.0 sparc
 - Redhat Linux 6.0 alpha
 - Redhat Linux 6.0
- Redhat Linux 5.2 sparc
 - Redhat Linux 5.2 i386
 - Redhat Linux 5.2 alpha
 - SCO eDesktop 2.4
- SCO eServer 2.3
- SuSE Linux 7.0
Netscape Communicator 4.07
- Caldera OpenLinux Desktop 2.3
- Caldera OpenLinux eBuilder 3.0
- Mandriva Linux Mandrake 7.1
- Mandriva Linux Mandrake 7.0
- Mandriva Linux Mandrake 6.1
- Mandriva Linux Mandrake 6.0
- Microsoft Windows 2000 Professional
- Microsoft Windows 95
- Microsoft Windows 98
- Microsoft Windows NT 4.0
 - Redhat Linux 6.2 sparc
 - Redhat Linux 6.2 i386
 - Redhat Linux 6.2 alpha
 - Redhat Linux 6.1 sparc
 - Redhat Linux 6.1 i386
 - Redhat Linux 6.1 alpha
 - Redhat Linux 6.0 sparc
 - Redhat Linux 6.0 alpha
 - Redhat Linux 6.0
- Redhat Linux 5.2 sparc
 - Redhat Linux 5.2 i386
 - Redhat Linux 5.2 alpha
 - SCO eDesktop 2.4
- SCO eServer 2.3
- SuSE Linux 7.0
Netscape Communicator 4.06
- Caldera OpenLinux Desktop 2.3
- Caldera OpenLinux eBuilder 3.0
- Mandriva Linux Mandrake 7.1
- Mandriva Linux Mandrake 7.0
- Mandriva Linux Mandrake 6.1
- Mandriva Linux Mandrake 6.0
- Microsoft Windows 2000 Professional
- Microsoft Windows 95
- Microsoft Windows 98
- Microsoft Windows NT 4.0
 - Redhat Linux 6.2 sparc
 - Redhat Linux 6.2 i386
 - Redhat Linux 6.2 alpha
 - Redhat Linux 6.1 sparc
 - Redhat Linux 6.1 i386
 - Redhat Linux 6.1 alpha
 - Redhat Linux 6.0 sparc
 - Redhat Linux 6.0 alpha
 - Redhat Linux 6.0
- Redhat Linux 5.2 sparc
 - Redhat Linux 5.2 i386
 - Redhat Linux 5.2 alpha
 - SCO eDesktop 2.4
- SCO eServer 2.3
- SuSE Linux 7.0
NcFTP Software NcFTPD 2.3.5
IBM AIX 4.3.2
IBM AIX 4.3

Discussion

Multiple Vendor FTP pipe Vulnerability

There is a feature implementation in a number of ftp clients shipped with unix operating systems that may be a security threat.

This issue has to do with handling filenames when the user is specifying files to be retrieved from an ftp server.

If the filename begins with a '|' character, the client will execute the following characters in the filename as shell commands.

The command execution is the result of the client misinterpreting the user-input.

An attacker may be able to exploit this if files can be placed on the server with '|' characters in the filename. The victim would then have to attempt to retrieve the files.

Exploit / POC

Multiple Vendor FTP pipe Vulnerability

There is no exploit required.

Solution / Fix

Multiple Vendor FTP pipe Vulnerability

Solution:
SGI have released an advisory (20030304-01-P) with details that address this issue. A number of patches to fix this vulnerability have also been provided. SGI have recommended that users upgrade to IRIX 6.5.20 or install the appropriate version specific patch.

RedHat has released an advisory and fixes, see advisory link below.

Mandrake Linux has made fixes available for the Kerberos FTP Client. See the referenced advisory for additional details.

IBM Has the following APAR's available to address this problem:

AIX 4.1
---------
APAR # IX70885

AIX 4.2
---------
APAR # IX70886

Hewlett Packard has made the folowing patches available to address this problem:

Install the applicable patches for the fileset: ARPA-RUN ARPA-MAN
HP-UX release 9.X PHNE_13595

Install the applicable patches for the fileset: InternetSrvcs.INETSVCS-RUN or InternetSrvcs.INET-ENG-A-MAN.

HP-UX release 10.0,10.01,10.10 PHNE_13596
HP-UX release 10.16 PHNE_16006
HP-UX release 10.20 PHNE_13597
HP-UX release 10.24 PHNE_15802
HP-UX release 11.00 PHNE_14479

Install the applicable patches for the fileset: InternetSvcSec.INETSVCS-SEC or InternetSvcSec.ISEC-ENG-A-MAN, (Secure Internet Services),

HP-UX release 10.20 PHNE_15544

Sun Microsystems has made the following patches avaialable to address this problem:

SunOS Patch ID
_____ _________
SunOS 5.6 sparc 106522-01
SunOS 5.6 x86 106523-01
SunOS 5.5.1 sparc 103603-09
SunOS 5.5.1 x86 103604-09
SunOS 5.5 sparc 103577-09
SunOS 5.5 x86 103578-09
SunOS 5.4 sparc 101945-60
SunOS 5.4 x86 101946-53
SunOS 5.3 sparc 101653-02
SunOS 4.1.4 sparc 104477-04
SunOS 4.1.3_U1 sparc 104454-04

SCO has released a security advisory for UnixWare and OpenUnix which contains the appropriate fixes. Users are advised to upgrade as soon as possible.

HP has released an updated advisory (HPSBUX01050) and fixes to address this issue in HP-UX 11.00, 11.04, 11.11, and 11.22. Please see the referenced advisory for further details regarding obtaining and applying appropriate fixes.


Redhat krb5-server-1.2.2-13.i386.rpm

Redhat krb5-server-1.2.4-1.i386.rpm

Redhat krb5-workstation-1.2.4-1.i386.rpm

Redhat krb5-devel-1.2.5-6.i386.rpm

Redhat krb5-devel-1.2.1-8.i386.rpm

Redhat krb5-server-1.2.1-8.i386.rpm

Redhat krb5-libs-1.2.4-1.i386.rpm

Redhat krb5-server-1.2.5-6.i386.rpm

Redhat krb5-workstation-1.2.5-6.i386.rpm

Redhat krb5-libs-1.2.1-8.i386.rpm

Redhat krb5-libs-1.2.2-13.i386.rpm

Redhat krb5-devel-1.2.2-13.i386.rpm

Redhat krb5-workstation-1.1.1-9.i386.rpm

Redhat krb5-devel-1.2.4-1.i386.rpm

Redhat krb5-server-1.1.1-9.i386.rpm

Redhat krb5-workstation-1.2.2-13.i386.rpm

Redhat krb5-workstation-1.2.1-8.i386.rpm

Redhat krb5-configs-1.1.1-9.i386.rpm

Redhat krb5-libs-1.2.5-6.i386.rpm

Redhat krb5-devel-1.1.1-9.i386.rpm

Redhat krb5-libs-1.1.1-9.i386.rpm

Redhat Linux 6.2 i386

Redhat Linux 7.0 i386

Caldera UnixWare 7.1.1

Caldera UnixWare 7.1.3

Redhat Linux 7.2 ia64

Redhat Linux 7.2 i386

Redhat Linux 7.3 i386

Caldera OpenUnix 8.0

Redhat Linux 8.0 i386

References

Multiple Vendor FTP pipe Vulnerability

References:

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report