Off-by-one error in the fb_realpath() function, as derived from the realpath function in BSD, may allow attackers to execute arbitrary code, as demonstrated in wu-ftpd 2.5.0 through 2.6.2 via commands that cause pathnames of length MAXPATHLEN+1 to trigger a buffer overflow, including (1) STOR, (2) RETR, (3) APPE, (4) DELE, (5) MKD, (6) RMD, (7) STOU, or (8) RNTO.

A vulnerability was discovered by Janusz Niewiadomski and Wojciech Purczynski in the wu-ftpd FTP server package. They found an off-by- one bug in the fb_realpath() function which could be used by a remote attacker to obtain root privileges on the server. This bug can only be successfully accomplished by using wu-ftpd binaries compiled on Linux 2.0.x and later 2.4.x kernels because the 2.2.x and earlier 2.4.x kernels define PATH_MAX to be 4095 characters.

wu-ftpd is no longer shipped with Mandrake Linux, however Mandrake Linux 8.2 did come with wu-ftpd. If you use wu-ftpd, you are encouraged to upgrade to these patched packages.

s700_800 11.00 ftpd(1M) and ftp(1) patch : 

The remote HP-UX host is affected by multiple vulnerabilities :

  - A potential security vulnerability has been identified     with HP-UX running ftp where the vulnerability could be     exploited remotely to allow unauthorized access.
    (HPSBUX01050 SSRT3456)

  - A potential security vulnerability has been identified     with HP-UX running ftpd, where a buffer overflow in ftpd     could be remotely exploited to allow an unauthorized     user to gain privileged access. (HPSBUX01118 SSRT4883)

  - The wu-ftpd program is potentially vulnerable to a     buffer overflow. (HPSBUX00277 SSRT3606)

s700_800 11.11 ftpd(1M) and ftp(1) patch : 

The remote HP-UX host is affected by multiple vulnerabilities :

  - The wu-ftpd program is potentially vulnerable to a     buffer overflow. (HPSBUX00277 SSRT3606)

  - A potential security vulnerability has been identified     with HP-UX running ftpd, where a buffer overflow in ftpd     could be remotely exploited to allow an unauthorized     user to gain privileged access. (HPSBUX01118 SSRT4883)

  - A potential security vulnerability has been identified     with HP-UX running ftp where the vulnerability could be     exploited remotely to allow unauthorized access.
    (HPSBUX01050 SSRT3456)

s700_800 11.22 ftpd(1M) and ftp(1) patch : 

The remote HP-UX host is affected by multiple vulnerabilities :

  - A potential vulnerability has been identified with HP-UX     running ftpd where the vulnerability could be exploited     to allow a remote authorized user unauthorized access to     files. (HPSBUX01119 SSRT4694)

  - A potential security vulnerability has been identified     with HP-UX running ftp where the vulnerability could be     exploited remotely to allow unauthorized access.
    (HPSBUX01050 SSRT3456)

  - The wu-ftpd program is potentially vulnerable to a     buffer overflow. (HPSBUX00277 SSRT3606)

  - A potential security vulnerability has been identified     with HP-UX running ftpd, where a buffer overflow in ftpd     could be remotely exploited to allow an unauthorized     user to gain privileged access. (HPSBUX01118 SSRT4883)

  - A potential vulnerability has been identified with HP-UX     running wu-ftpd with the restricted gid option enabled     where the vulnerability could be exploited by a local     user to gain unauthorized access to files. (HPSBUX01059     SSRT4704)

iSEC Security Research reports that wu-ftpd contains an off-by-one bug in the fb_realpath function which could be exploited by a logged-in user (local or anonymous) to gain root privileges. A demonstration exploit is reportedly available.

The remote host is missing the patch for the advisory SUSE-SA:2003:032 (wuftpd).


Janusz Niewiadomski and Wojciech Purczynski of iSEC Security Research have found a single byte buffer overflow in the Washington University ftp daemon (wuftpd), a widely used ftp server for Linux-like systems.
It is yet unclear if this bug is (remotely) exploitable. Positive exploitability may result in a remote root compromise of a system running the wuftpd ftp daemon.

Notes:
* SUSE LINUX products do not contain wuftpd any more starting with SUSE Linux 8.0 and SUSE LINUX Enterprise Server 8. The wuftpd package has been substituted by a different server implementation of the file transfer protocol server.
* The affected wuftpd packages in products as stated in the header of this announcement actually ship two different wuftpd ftp daemon versions: The older version 2.4.x that is installed as /usr/sbin/wu.ftpd, the newer version 2.6 is installed as /usr/sbin/wu.ftpd-2.6 . The 2.4.x version does not contain the defective parts of the code and is therefore not vulnerable to the weakness found.
* If you are using the wuftpd ftp daemon in version 2.4.x, you might want to update the package anyway in order not to risk an insecure configuration once you switch to the newer version.

There exists no workaround that can fix this vulnerability on a temporary basis other than just using the 2.4.x version as mentioned above.
The proper fix for the weakness is to update the package using the provided update packages.

Please download the update package for your distribution and verify its integrity by the methods listed in section 3) of this announcement.
Then, install the package using the command 'rpm -Fhv file.rpm' to apply the update.

Updated wu-ftpd packages are available that fix an off-by-one buffer overflow.

The wu-ftpd package contains the Washington University FTP (File Transfer Protocol) server daemon. FTP is a method of transferring files between machines.

An off-by-one bug has been discovered in versions of wu-ftpd up to and including 2.6.2. On a vulnerable system, a remote attacker would be able to exploit this bug to gain root privileges.

Red Hat Enterprise Linux contains a version of wu-ftpd that is affected by this bug, although it is believed that this issue will not be remotely exploitable due to compiler padding of the buffer that is the target of the overflow. However, Red Hat still advises that all users of wu-ftpd upgrade to these erratum packages, which contain a security patch.

Red Hat would like to thank Wojciech Purczynski and Janusz Niewiadomski of ISEC Security Research for their responsible disclosure of this issue.

The remote WU-FTPD server seems to be vulnerable to an off-by-one overflow when dealing with huge directory structures. 

An attacker may exploit this flaw to obtain a shell on this host. 

Note that Nessus has solely relied on the banner of the remote server to issue this warning so it may be a false-positive, especially if the patch has already been applied.

ID	Name	Product	Family	Severity
61921	Mandrake Linux Security Advisory : wu-ftpd (MDKSA-2003:080)	Nessus	Mandriva Local Security Checks	critical
16909	HP-UX PHNE_29460 : s700_800 11.00 ftpd(1M) and ftp(1) patch	Nessus	HP-UX Local Security Checks	critical
16908	HP-UX PHNE_29461 : s700_800 11.11 ftpd(1M) and ftp(1) patch	Nessus	HP-UX Local Security Checks	critical
16907	HP-UX PHNE_29462 : s700_800 11.22 ftpd(1M) and ftp(1) patch	Nessus	HP-UX Local Security Checks	critical
15194	Debian DSA-357-1 : wu-ftpd - remote root exploit	Nessus	Debian Local Security Checks	critical
13801	SUSE-SA:2003:032: wuftpd	Nessus	SuSE Local Security Checks	critical
12413	RHEL 2.1 : wu-ftpd (RHSA-2003:246)	Nessus	Red Hat Local Security Checks	critical
11811	WU-FTPD fb_realpath() Function Off-by-one Overflow	Nessus	FTP	critical

Detections

Analytics

CVE-2003-0466

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical