CERT Advisory CA-2001-07 File Globbing Vulnerabilities in Various FTP Servers

Overview

Filename "globbing" is the process of expanding short-hand notation into complete file names. For example, the expression "*.c" (without the quotes) is short-hand notation for "all files ending in ".c" (again, without the quotes). This is commonly used in UNIX shells, in commands such as ls *.c. Globbing also often includes the expansion of certain characters into system-specific paths, such as the expansion of tilde character (~) into the path of the home directory of the user specified to the right of the tilde character. For example, "~foo" expands to the home directory for the user "foo" on the current system. The expressions used in filename globbing are not strictly regular expressions, but they are syntactically similar in many ways.

Many FTP servers also implement globbing, so that the command mget *.c means retrieve all the files ending in ".c," and get ~foo/file.name means get the file named "file.name" in the home directory of foo.

The COVERT Labs at PGP Security have discovered a means to use the expansion done by the glob function to overflow various buffers in FTP servers, allowing an intruder to execute arbitrary code. For more details about their discovery, see

II. Impact

Appendix A. - Vendor Information

This appendix contains information provided by vendors for this advisory. When vendors report new information to the CERT/CC, we update this section and note the changes in our revision history. If a particular vendor is not listed below, we have not received their comments.

Apple

COMPAQ COMPUTER CORPORATION

-----------------------------
x-ref: J Compaq case id - SSRT1-83

At the time of writing this document, Compaq is currently investigating the potential impact to Compaq's ftp service.

Initial tests indicate Compaq's ftp service is not vulnerable.

As further information becomes available Compaq will provide notice of the completion/availibility of any necessary patches through AES services (DIA,DSNlink FLASH and posted to the Services WEB page) and be available from your normal Compaq Services Support channel.

[...] we have determined that the versions of UXP/V shown below are vulnerable. JPatches are being prepared and will be assigned the patch numbers also shown below:

OS Version,PTF level patch ID
-------------------- --------
UXP/V V20L10 X01021  UX28161
UXP/V V20L10 X00091  UX28160
UXP/V V10L20 X01041  UX15527

Hewlett-Packard Company

As originally stated in the NAI Covert labs Advisory, HP is vulnerable. We will be releasing four patches, one each for Pre 10.20, 10.20 , 11.00 and 11.11. Watch for the associated HP security Bulletin announcing the patches when coding and testing is successfully completed.

IBM Corporation

SGI acknowledges the vulnerability reported by NAI COVERT Labs and is currently investigating. No further information is available at this time.

As further information becomes available, additional advisories will be issued via the normal SGI security information distribution methods including the wiretap mailing list and http://www.sgi.com/support/security/

For the protection of all our customers, SGI does not disclose, discuss or confirm vulnerabilities until a full investigation has occurred and any necessary patch(es) or release streams are available for all vulnerable and supported IRIX operating systems.

Until SGI has more definitive information to provide, customers are encouraged to assume all security vulnerabilities as exploitable and take appropriate steps according to local site security policies and requirements.

The CERT Coordination Center would like to thank the COVERT Labs at PGP Security for notifying us about this problem and for their help in constructing this advisory.