|
Brought to you by:
Suppliers of:
|
|
|
| |
| BFTPd is a Linux FTP server with chroot and setreuid functionality. The latest version of BFTP has a potential security problem when the SITE CHOWN command is requested to change the ownership of a file. The vulnerability allows remote attackers to overflow internal buffers, and execute arbitrary code. |
| |
Credit:
The information has been provided by BAILLEUX Christophe.
|
| |
Example:
230 User logged in.
site chown AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.AAAAAAAAAA A
550 User 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA' not found.
Connection closed by foreign host.
The problem is in the command_chown function in commands.c :
465 void command_chown(char *params) {
466 char foo[USERLEN + 1], owner[USERLEN + 1], group[USERLEN + 1], filename[256];
467 int uid, gid;
468 if(!strstr(params, " ")) {
469 fprintf(stderr, "550 Usage: SITE CHOWN <owner>[.<group>] <filename>\r\n");
470 return;
471 }
472 sscanf(params, "%[^ ] %s", foo, filename);
473 if(strstr(foo, "."))
474 sscanf(foo, "%[^.].%s", owner, group);
475 else {
476 strcpy(owner, foo);
477 group[0] = '\0';
478 }
479 if(!sscanf(owner, "%i", &uid)) /* Is it a number? */
480 if(((uid = mygetpwnam(owner, passwdfile))) < 0) {
481 fprintf(stderr, "550 User '%s' not found.\r\n", owner);
482 return;
483 }
Workaround:
Replace in /etc/bftpd.conf:
ENABLE_SITE=yes
By
ENABLE_SITE=no
|
|
|
|
|
