Last revised: May 09, 2001
Source: CERT/CC
A complete revision history can be found at the end of this file.
Systems Affected
FTP servers on various platformsOverview
A variety of FTP servers incorrectly manage buffers in a way that
can lead to remote intruders executing arbitrary code on the FTP
server. The incorrect management of buffers is centered around the
return from the glob() function, and may be confused with a related
denial-of-service problem. These problems were discovered by the
COVERT Labs at PGP Security.
Filename "globbing" is the process of expanding short-hand notation
into complete file names. For example, the expression "*.c" (without
the quotes) is short-hand notation for "all files ending in ".c"
(again, without the quotes). This is commonly used in UNIX shells, in
commands such as ls *.c. Globbing also often includes the expansion of
certain characters into system-specific paths, such as the expansion
of tilde character (~) into the path of the home directory of the user
specified to the right of the tilde character. For example, "~foo"
expands to the home directory for the user "foo" on the current
system. The expressions used in filename globbing are not strictly
regular expressions, but they are syntactically similar in many
ways. Many FTP servers also implement globbing, so that the command
mget *.c means retrieve all the files ending in ".c," and get
~foo/file.name means get the file named "file.name" in the home
directory of foo.
The COVERT Labs at PGP Security have discovered a means to use the
expansion done by the glob function to overflow various buffers in FTP
servers, allowing an intruder to execute arbitrary code. For more
details about their discovery, see
Quoting from that document:
[...] when an FTP daemon receives a request involving a file that has
a tilde as its first character, it typically runs the entire filename
string through globbing code in order to resolve the specified home
directory into a full path. This has the side effect of expanding
other metacharacters in the pathname string, which can lead to very
large input strings being passed into the main command processing
routines. This can lead to exploitable buffer overflow conditions,
depending upon how these routines manipulate their input.
For the latest information regarding this vulnerability, including
information related to vendors' exposure to this problem, consult the
vulnerability note describing this problem, available at
Intruders can execute arbitrary code with the permissions of the
process running the FTP server.
This appendix contains information provided by vendors for this
advisory. When vendors report new information to the CERT/CC, we
update this section and note the changes in our revision history. If
a particular vendor is not listed below, we have not received their
comments. Mac OS X 10.0.2 and later include a fix for File Globbing vulnerability.
COMPAQ COMPUTER CORPORATION ----------------------------- At the time of writing this document, Compaq is currently
investigating the potential impact to Compaq's ftp service.
Initial tests indicate Compaq's ftp service is not vulnerable.
As further information becomes available Compaq will
provide notice of the completion/availibility of any necessary
patches through AES services (DIA,DSNlink FLASH and posted
to the Services WEB page) and be available from your normal
Compaq Services Support channel. COMPAQ COMPUTER CORPORATION
FreeBSD is vulnerable to the glob-related bugs. We have corrected
these bugs in FreeBSD 5.0-CURRENT and FreeBSD 4.2-STABLE, and they
will not be present in FreeBSD 4.3-RELEASE.
[...] we have determined that the versions of UXP/V shown below are
vulnerable. JPatches are being prepared and will be assigned the patch
numbers also shown below:
As originally stated in the NAI Covert labs Advisory,
HP is vulnerable. We will be releasing four patches,
one each for Pre 10.20, 10.20 , 11.00 and 11.11.
Watch for the associated HP security Bulletin announcing
the patches when coding and testing is successfully
completed.
[...] we have not found the described vulnerabilities to exist in the
AIX versions of glob as used in the ftp daemon.
Please be aware that as of March 29, 2001, NetBSD has a fix for
both the glob resource consumption (via an application controlled
GLOB_LIMIT flag) and the buffer overflow (always enforced). These
fixes should work on any 4.4BSD derived glob(3).
publicfile has none of these bugs, deliberately avoids globbing,
and has never used any ftpd-derived code. See
http://cr.yp.to/publicfile.html.
SGI acknowledges the vulnerability reported by NAI COVERT Labs and is
currently investigating. No further information is available at this
time.
As further information becomes available, additional advisories will
be issued via the normal SGI security information distribution methods
including the wiretap mailing list and
http://www.sgi.com/support/security/
For the protection of all our customers, SGI does not disclose,
discuss or confirm vulnerabilities until a full investigation has
occurred and any necessary patch(es) or release streams are available
for all vulnerable and supported IRIX operating systems.
Until SGI has more definitive information to provide, customers are
encouraged to assume all security vulnerabilities as exploitable and
take appropriate steps according to local site security policies and
requirements.
The CERT Coordination Center would like to thank the COVERT Labs at
PGP Security for notifying us about this problem and for their help in
constructing this advisory. Author: Shawn
V. Hernan
Copyright 2001 Carnegie Mellon University. Revision History
I. Description
II. Impact
III. Solution
Apply a patch or workaround from your vendor, as described in Appendix
A.
Appendix A. - Vendor Information
Apple
Compaq Computer Corporation
x-ref: J Compaq case id - SSRT1-83
FreeBSD, Inc.
Fujitsu
OS Version,PTF level patch ID
-------------------- --------
UXP/V V20L10 X01021 UX28161
UXP/V V20L10 X00091 UX28160
UXP/V V10L20 X01041 UX15527
Hewlett-Packard Company
IBM Corporation
NetBSD
publicfile
SGI
April 10, 2001: Initial release
April 10, 2001: Added a statement from publicfile
May 09, 2001: Added a statement from HP
May 16, 2001: Added a statement from Apple