Buffer overflow in the glob implementation (glob.c) in libc in NetBSD-current before 20050914, NetBSD 2.* and 3.* before 20061203, and Apple Mac OS X before 2007-004, as used by the FTP daemon and tnftpd, allows remote authenticated users to execute arbitrary code via a long pathname that results from path expansion.

The remote host is running a version of Mac OS X 10.4 that does not have Security Update 2007-004 applied.

This update fixes security flaws in the following applications :

AFP Client AirPort CarbonCore diskdev_cmds fetchmail ftpd gnutar Help Viewer HID Family Installer Kerberos Libinfo Login Window network_cmds SMB System Configuration URLMount Video Conference WebDAV

The tnftpd port suffer from a remote stack overrun, which can lead to a root compromise.

The remote host is running TNFTPD, a port of the NetBSD FTP daemon.  This version of TNFTPD is vulnerable to a remote buffer overflow.  The flaw is within the glob.c function.  An attacker exploiting this flaw would need to authenticate to the server and then pass a malformed string that would be interpreted by the glob function.  Successful exploitation results in the attacker executing arbitrary code on the remote system.

ID	Name	Product	Family	Severity
25081	Mac OS X Multiple Vulnerabilities (Security Update 2007-004)	Nessus	MacOS X Local Security Checks	critical
23852	FreeBSD : tnftpd -- Remote root Exploit (e969e6cb-8911-11db-9d01-0016179b2dd5)	Nessus	FreeBSD Local Security Checks	high
3836	TNFTPD < 20040811 Globbing Overflow	Nessus Network Monitor	FTP Servers	medium

Detections

Analytics

CVE-2006-6652

high

Tenable Plugins

critical

high

medium