Detections
Analytics

WU-FTPD S/KEY Authentication ftpd.c skey_challenge Function Remote Overflow

critical Nessus Plugin ID 14372

Language:

Synopsis

The remote FTP server seems to be vulnerable to a remote buffer overflow.

Description

This version of WU-FTPD contains a remote overflow if s/key support is enabled. The skey_challenge function fails to perform bounds checking on the name variable resulting in a buffer overflow. With a specially crafted request, an attacker can execute arbitrary code resulting in a loss of integrity and/or availability.

It appears that this vulnerability may be exploited prior to authentication.
It is reported that S/Key support is not enabled by default, though some operating system distributions which ship WU-FTPD may have it enabled.

*** Nessus solely relied on the banner of the remote server
*** to issue this warning, so it may be a false positive.

Solution

Upgrade to WU-FTPD 2.6.3 when available or disable SKEY or apply the patches available at http://www.wu-ftpd.org

See Also

http://www.securiteam.com/unixfocus/6X00Q1P8KC.html

Plugin Details

Severity: Critical

ID: 14372

File Name: wu_ftpd_skey_remote_buff.nasl

Version: 1.20

Type: remote

Family: FTP

Published: 8/25/2004

Updated: 8/7/2018

Configuration: Enable paranoid mode

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

Required KB Items: Settings/ParanoidReport, ftp/login, ftp/wuftpd

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 6/7/2000

Reference Information

CVE: CVE-2004-0185

BID: 8893

DSA: DSA-457-1

RHSA: 2004:096-09