Immune Systems:
* OpenFTPD 0.30.2 - Immune since 2004-07-16
Impact:
Remote execution of arbitrary code by an attacker having a working FTP account on the remote server
Technical Details:
When a user sends a message to another user using the SITE MSG command an external program will be called (msg). It is used by the OpenFTPD message handling.
andi@hoagie:~$ ncftp
...
...
ncftp / > site msg purge
All the messages in trash box purged.
ncftp / > site msg send andi "AAAA%08x|%08x|%08x|%08x|%08x|%08x|%08x|%08x|%08x|%08x]"
Message sent to andi.
ncftp / > site msg read
Vulnerable Code:
From openftpd-daily/src/misc/msg.c, function cat_message():
--------------------------------- Begin Code ---------------------------------
...
while (fgets(buff, 67, file)) {
if (*(buff+strlen(buff)-1) == '\n') *(buff+strlen(buff)-1) = 0;
sprintf(str, " !C| !0%-66s !C|!0\n", buff);
printf(str); //<--- should be printf("%s",str);
}
...
---------------------------------- End Code ----------------------------------
Vendor Status:
The vendor has been contacted and a newer version is available for download. Users are encouraged to upgrade to the newer version, which is available at www.openftpd.org.
