Subject: CERT Security Announcement

From: [email-masked] (Javanet Cafe Mail)
Date: Sat, 2 Dec 1995 09:47:48 -0400

I just read the recent announcement from CERT about the security holes in the
wu-ftpd daemon.  Where can I get the latest beta that fixes this problem?

Steve Morin

---

From: Chris Woods <[email-masked]>
Date: Sat, 2 Dec 1995 09:37:37 -0500 (EST)

> wu-ftpd daemon.  Where can I get the latest beta that fixes this problem?

THe problem is not with wu-ftpd itself, but with the way it is/was
compiled in some binary distributions. Any version of wu-ftpd, compiled
properly, will not be subject to that hole. 

    Chris Woods				Systems Administrator
    [email-masked]			USAinternet, Inc.
    http://www.usa1.com/~cjwoods	508-774-4700
  "A computer without Windows is like a fish without a bicycle."

---

From: "John Grimm" <[email-masked]>
Date: Sat, 2 Dec 1995 09:35:33 -0800

I want to know the same. Would you please summarize this on the list for all to
see?

John

-- 

************************************************************************
                               EDM NetWORK
                             
EDM NetWORK					Phone (714) 476-0416
17785 Sky Park Circle				Fax   (714) 476-8621
Suite B						Email: [email-masked]
Irvine, Ca 92714				INFO:  [email-masked]
                   
                   *now who get the deer, me or the dog?*
************************************************************************

---

From: Dovid Zirkind <[email-masked]>
Date: Sun, 3 Dec 1995 02:47:16 -0500

> properly, will not be subject to that hole. 

When I compiled wu-ftpd-2.4, the anon login was able to DEL files which are 
world readable! (while the one that has the SITE EXEC bug does not have 
that prob.)

Example file:

-rw-r--r-- root    root 30 Nov      0 Whatever-File

---

From: [email-masked] (Bill Gercken)
Date: Sun, 3 Dec 1995 09:43:10 -0500 (EST)

> -rw-r--r-- root    root 30 Nov      0 Whatever-File
What were the permisions on the parent directory?
And who owns it?

bill

---

From: Dovid Zirkind <[email-masked]>
Date: Sun, 3 Dec 1995 15:37:08 -0500

> What were the permisions on the parent directory?

-rwx-wx-wx root     root         incoming

(actualy if i do "su ftp", I can rm the file after the prompt:
	rm: remove `Whatever-File', overwriding mode 0644? y
which is also questionable why this is allowed!)

                        +------------------------------+
                        |    http://www.chabad.org     |
                        |  gopher://gopher.chabad.org  |
                        +------------------------------+

---

From: Russell Street <[email-masked]>
Date: Mon, 4 Dec 1995 08:50:04 +1300 (NDT)

> which is also questionable why this is allowed!)

Why?  Because you can write in the directory, so you can remove the
file.

Set the sticky bit on the directory, if your OS supports it
	chmod +t incoming

Add these lines to your ftpaccess file:

	chmod           no      anonymous
	delete          no      anonymous
	rename          no      anonymous
	overwrite       no      anonymous
	umask           no      anonymous
 
(assuming your anonymous class is called 'anonymous')

and while you are at it:

	path-filter anonymous /etc/allowed.filenames ^[-A-Za-z0-9\._]*$ ^\. ^-

	upload  /ftp    *               no nodirs
	upload  /ftp    /incoming       yes root ftpadmin 0660 nodirs

Can also be very useful.

Hope this is of some help,
Russell
 -------------------------------------------------------------------
 Russell Street ([email-masked]) +64 (9) 373-7599 extn 6487
	 Data Network Services, ITSS, University of Auckland

---

From: "R. Reginald Sprinkhuizen" <[email-masked]>
Date: Sun, 3 Dec 1995 20:52:15 +0100 (MET)

On Sun, 3 Dec 1995, Dovid Zirkind wrote:
> > > [...RUDE CUT...] 

No, it is not! The answer is: RTFM!! Looks like another DOS-aholic entered
the scene!!!

[NOVICE MODE ON]
The ability of removing a file is ALSO determined by the directory it is in.
If you can remove the file as by the file-settings, everybody knows why. 
But if the directory it is in, and the directory-settings specify you may 
write in it, you can also delete the file (this is where the DOS-gurus 
;-) look supprised). But in this case, *NIX will give you the opportunity
to change your mind (just because it knows you DOSsers would be supprised!).
[NORMAL MODE]

Good luck on your journey throught the REAL world (which of course excludes
the use of M$-DOS and M$-Win95 B.C. . . . )

+---.  +---.   .----,  ==  R. Reginald Sprinkhuizen
| o  ) | o  ) (   (    ==  Reina Prinsen-Geerligspad 9
|   <  |   <   )   )   ==  3207 GN SPIJKENISSE (The Netherlands)
!_|\_\ !_|\_\ |___/    ==  +31-181-632722

---

From: Brian Harvell <[email-masked]>
Date: Sun, 3 Dec 1995 14:49:43 -0500 (EST)

> which is also questionable why this is allowed!)

This is normal for any directory.  If the user has write perms to the directory
they can blow anything away.  Just look at /tmp.

That is of course if the sticky bit is not set.

Brian

---

From: [email-masked] (Koos van den Hout _U nix and we all_)
Date: Sun, 3 Dec 1995 21:06:33 +0100 (MET)

> wu-ftpd daemon.  Where can I get the latest beta that fixes this problem?

Reread the announcement. That is not about a hole in the daemon itself, it
is about a very misconfigured daemon that was shipped with a Linux installation
set, which opened a security hole.

Getting the source from (relative to your slackware source path) :

source/n/tcpip/wu-ftpd-2.4.tar.gz

                                           Grtx. KH

-- 
  Koos van den Hout,           Internetter, Unix freak and BBS SysOp at large
  [email-masked] (Home)        BBS Koos z'n Doos (+31-30-6036637 28k8)
  [email-masked] (Work)  <-- finger -l for PGPkey    (+31-30-6056619 14k4)
  http://www.hvu.nl/~koos (WWW)    Looking for a license plate with "RFC 822"
  We are root. You will be assimilated. Resistance is useless. Clickety Click

---

From: Feisal Mohammed <[email-masked]>
Date: Mon, 4 Dec 1995 12:22:25 -0400 (AST)

I found a serious bug in the academ 2.4 release 7 ftpd.
Users who don't have valid shells but have accounts
are allowed to ftp. I have since gone back to the
original 2.4 from WU.
The two compiles were on AIX3.2.5 and used the
default makefiles for AIX.

-Feisal
University of the West Indies

---

From: Chris Woods <[email-masked]>
Date: Mon, 4 Dec 1995 13:37:39 -0500 (EST)

> are allowed to ftp. I have since gone back to the

Give these users a shell like /dev/null or /etc/ftponly, and put the name
of the shell you assign them into /etc/shells. If they attempt to ftp and
there is no specified shell for the user in /etc/passwd, I think that it
is assumed that they are using the "default shell", /bin/sh on every
system I've ever used.

---

From: Feisal Mohammed <[email-masked]>
Date: Mon, 4 Dec 1995 18:10:46 -0400 (AST)

> is assumed that they are using the "default shell", /bin/sh on every
I guess I didn't explain myself properly. Sorry :) These users have
shells like /usr/local/bin/noshell in the /etc/passwd and
only the standard shells are listed in the /etc/shells e.g 
tcsh, ksh, and sh.
Yet academ 2.4.2 beta 7 allows these users to login as if their
shells were listed in the /etc/shells.

-Feisal

---

From: Chris Woods <[email-masked]>
Date: Mon, 4 Dec 1995 19:03:58 -0500 (EST)

> shells were listed in the /etc/shells.

Hmm, I see what you mean. If that is the case, it definitely appears as a
hole...

---

From: Nik Conwell <[email-masked]>
Date: Tue, 5 Dec 1995 08:43:58 -0500 (EST)

> Hmm, I see what you mean. If that is the case, it definitely appears as a

AIX uses /etc/security/login.cfg for the shell list.  I'm not sure if the AIX
supporting code proposed by a few people actually made it into 2.4.2b7... 
-nik