Glftpd Remote Vulnerabilities
BID:891
Info
Glftpd Remote Vulnerabilities
| Bugtraq ID: | 891 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | Yes |
| Published: | Dec 23 1999 12:00AM |
| Updated: | Dec 23 1999 12:00AM |
| Credit: | First posted to Bugtraq by suid <[email protected]> on December 23, 1999. |
| Vulnerable: |
GlFtpd GlFtpd 1.17.2 |
| Not Vulnerable: | |
Discussion
Glftpd Remote Vulnerabilities
GlFtpd is a popular alternative to the mainstream unix ftp daemons and is currently in wide use on the internet. There are three known serious vulnerabilities in GlFtpd. The first problem is an account which is created by default upon installation of the software. The username and password for this account are both "gltftpd" and the uid is 0 (root). This account can only be used by users connecting from localhost. This is a problem because "local users" can log into a host's glftpd with root privileges (and compromise the entire system). The second problem is world writeable ~/site directory. The last problem is the possibility to execute arbitrary commands on the target host. Glftpd comes with a feature called ZIPCHK, which is a command sent to the ftpd to check the integrity of a zip file on the server remotely. ZIPCHK executes "unzip" on the file without validating the filename input. With a special filename such as " ; ls", it is possible to execute arbitrary commands as the uid of glftpd.
GlFtpd is a popular alternative to the mainstream unix ftp daemons and is currently in wide use on the internet. There are three known serious vulnerabilities in GlFtpd. The first problem is an account which is created by default upon installation of the software. The username and password for this account are both "gltftpd" and the uid is 0 (root). This account can only be used by users connecting from localhost. This is a problem because "local users" can log into a host's glftpd with root privileges (and compromise the entire system). The second problem is world writeable ~/site directory. The last problem is the possibility to execute arbitrary commands on the target host. Glftpd comes with a feature called ZIPCHK, which is a command sent to the ftpd to check the integrity of a zip file on the server remotely. ZIPCHK executes "unzip" on the file without validating the filename input. With a special filename such as " ; ls", it is possible to execute arbitrary commands as the uid of glftpd.
Exploit / POC
Solution / Fix
Glftpd Remote Vulnerabilities
Solution:
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Solution:
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].