Subject: Potential security hole in wu-ftpd

From: Michael Bauer <[email-masked]>
Date: Wed, 4 Sep 1996 15:03:31 -0400 (EDT)

Greetings:

I have recently discovered a limited-circumstances variation of the
old ftpd double-login bug in wuftpd 2.4 (running under Solaris 2.5).
This bug was fixed before the CERT came into existence, so I am rather
surprised to see it years later.

The variation I've found recently appears like this:

# ftp ftp
Connected to ftp.
220 ftp FTP server (Version wu-2.4(1) Wed Sep 4 14:09:00 EDT 1996) ready.
Name (ftp:root): root
530 User root access denied.
Login failed.
ftp> user root
331 Password required for root.
Password: <root's password here>
230 User root logged in.
ftp> 

Root was blocked the first time, but upon a second attempt, root is
allowed in (with root's password).

In my experimentation, this only happens if root's ability to log in
is restricted with the ftphosts.  If root is in /etc/ftpusers, the
daemon is not susceptible to this particular problem.  However, if you
allow limited root ftp logins through allow and deny rules [*], the
double-login trick works.  Please note that root's password is
required for login; this is not a "gimme" hole.  However, if you are
trying to restrict root ftp logins from coming through a firewall but
allowing them inside the firewall, this could be a potential problem.

Interestingly, when I tried to track down what was going on in the
daemon with the -d flag, the problem disappeared.

MJB

* Initial experimentation would imply that a ftphosts file of the form
	deny  root host1.foo.com
	allow root *.foo.com
	deny  root *
is susceptible, but one of the form
	allow root *.foo.com
	deny  root *
is not.