Subject: SECURITY: problem with some wu-ftpd-2.4 binaries (fwd)

From: "Alexander L. Haiut" <[email-masked]>
Date: Thu, 1 Jun 1995 13:47:40 +0200 (GMT+0200)

This message has been posted to bugtraq, I'm forwarding it
	to wu-ftpd since I guess all people here use that daemon.

	Please check your wu-ftpd installation (even if you don't
	use pre-compiled binary from Linux Slackware). 

	As described below, the _PATH_EXECPATH set in src/pathnames.h
	SHOULD NOT BE SET to directory containing any executables you
	don't want to be run as root.

			Thanks!		Sincerely,
						--alex.

--

Alexander L. Haiut					       +971-7-461658
Math & CS System group		                            [email-masked]
Ben-Gurion University, Israel                  http://www.cs.bgu.ac.il/~alx/

---------- Forwarded message ----------
 Date: Wed, 31 May 1995 14:23:09 -0500 (CDT)
 From: Aleph One <[email-masked]>
 To: [email-masked]
 Subject: SECURITY: problem with some wu-ftpd-2.4 binaries (fwd)

---------- Forwarded message ----------
 Date: Wed, 31 May 95 02:49 MET DST
 From: Olaf Kirch <[email-masked]>
 To: [email-masked]
 Subject: SECURITY: problem with some wu-ftpd-2.4 binaries

-----BEGIN PGP SIGNED MESSAGE-----

Hi all,

There's a security hole in some Linux distributions involving
wu-ftpd-2.4. Some ftpd binaries have been compiled with a set of
defaults that allow anyone with an account on your machine to become the
root user. It appears that at least Slackware-2.0 and 2.2 are affected;
I have no information about other distributions. Anonymous FTP should
not be affected by this as long as you have only the `ls' command in

To find out if your machine is affected, ftp to your own account, log in
and enter this: quote "site exec bash -c id". If ftpd responds with
a line that says something like "uid=0(root) euid=1234(your_login)... ",
then your ftpd is vulnerable.

The obvious fix is to obtain the source of wu-ftpd-2.4 and recompile
it. The crucial part is the _PATH_EXECPATH define in src/pathnames.h.
It should NOT be set to /bin or any other regular directory. By default,
it is set to /bin/ftp-exec. Make sure this directory does not exist or
contains only harmless commands you are absolutely sure you would want
your users to execute as root.

Thomas Lundquist <[email-masked]> has posted a small patch
for src/ftpcmd.y that goes even further and disables the SITE EXEC
command altogether. It is appended at the end of this message.

All the fame goes to

	Michel			[email-masked]
	Thomas Lundquist	[email-masked]
	Aleph One		[email-masked]

Have a nice day
Olaf
- --
Olaf Kirch       |  --- o --- Nous sommes du soleil we love when we play
[email-masked]|    / | \   sol.dhoop.naytheet.ah kin.ir.samse.qurax
           For my PGP public key, finger [email-masked].
- ------------------------------------------------------------------
table
`!"#$%&'()*+,-./0123456789:;<=>?
@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_

P.S. (From Jeff Uphoff): Slackware 2.3 is also affected.Also, there is
a typo at the end of Olaf's first paragraph; it should read: "Anonymous
FTP should not be affected by this as long as you have only the `ls'
command in ~ftp/bin."
         ^^^^^^^^

---

From: robert chea <[email-masked]>
Date: Mon, 12 Jun 1995 12:06:53 -0700 (PDT)

Hi,

I'm trying to set up a guestgroup in my ftpaccess file. I have a user named
sany who's home directory is in ~ftp/guest/sany and who
has "/ftp/./guest/sany" as a home directory in the /etc/passwd file.

sany's group is "nobody" and so my line in ftpaccess says
guestgroup nobody

when i try to log on, the server tells me that 'guest priveleges can't be
set-login failed.'  does anyone know what i'm doing wrong?

thanks 

robert

P.S. in an unrelated question, whenever i do an ls, i always see files beginning
with a "." (dot).  is there a way to disable this?