Subject: BoS: ftpd bug (yes, again..) (fwd)

From: Alain Magloire <[email-masked]>
Date: Mon, 14 Apr 1997 14:02:48 -0400 (EDT)

Hello
 This was sent to a BOS mailing list, I thought it was appropriate
to x-post.

 There is a small glitch in the way ftpd(popen.c) handles the
arguments. I've sent mail to Mr Barber in Jan about this, but
my patch was not retain, it was probaly to drastic(I refused
to exec if argc was too long :-). The patch can still be found
if you browse the archive, I guess. But it may be best
if you wait for beta-14.

  The fix in beta-13 still have a problem, I believe
it's probably because the array, argv[], is not NULL terminated
if args goes over MAXG_ARGS.

See src/popen.c for the relevant code.

Wu-ftpd should not dump core or do anything else then dropping
the connection. Must signals are catch(randomsig()). I don't think
this buffer overrun can be exploitable because the function
never return (execv()); I'll send something to Stan(Mr Barber)
if he didn't already correct this.

Here is a trace of the loggin sesion:

read(0, "user ftp\n", 4096)             = 9
....
write(1, "331 Guest login ok, send your co"..., 68) = 68
...
read(0, "pass alainm@\n", 4096)         = 13
...
open("/var/log/xferlog", O_WRONLY|O_APPEND|O_CREAT, 0660) = 6
setregid(65535, 20)                     = 0
....
read(0, "list a a a a a a a a a a a a a a"..., 4096) = 256
...
getdtablesize()                         = 256
pipe([8, 9])                            = 8
--- SIGSEGV (Segmentation fault) ---
gettimeofday({861036685, 48545}, NULL)  = 0
...
send(3, "<155>Apr 14 12:51:25 ftpd[15573]"..., 55, 0) = 55
chdir("/")                              = 0
sigblock([IOT])                         = 0x400 (old mask [SEGV])
sigvec(SIGIOT, {SIG_DFL}, {0x363f8, [], 0}) = 0
sigvec(SIGIOT, {SIG_DFL}, NULL)         = 0
sigsetmask([SEGV])                      = 0x420 (old mask [IOT SEGV])
sigblock([ILL])                         = 0x400 (old mask [SEGV])
sigvec(SIGILL, {SIG_DFL}, {0x363f8, [], 0}) = 0
sigvec(SIGILL, {SIG_DFL}, NULL)         = 0
sigsetmask([SEGV])                      = 0x408 (old mask [ILL SEGV])
close(0)                                = 0
close(1)                                = 0
close(2)                                = 0
_exit(1)                                = ?

-- 
au revoir, alain
----
Aussi haut que l'on soit assis, on est toujours assis que sur son cul !!!

> From: Vadim Kolontsov <[email-masked]>
> To: [email-masked]
> Subject: BoS:  ftpd bug (yes, again..)
> 
> Hello,
> 
>   do you remeber a bug with "argc > 100" in ftpd_popen(), when users was
> able to kill your ftpd to produce core dump with shadow password? Ok, this bug
> (which was reported when 2.1 was the latest release) still presents
> in 2.2 & 3.0
>   Yes, ftpd was patched, but incompletely. It seems that this patches was 
> never tested (although I didn't check a patch against "kill -11" yet)
> 
>   Here is an additional patch for 3.0's ftpd
> 
> ============================== cut here ================================
> *** popen.c.old	Sun Apr 13 11:22:59 1997
> --- popen.c	Sun Apr 13 11:23:16 1997
> ***************
> *** 95,101 ****
>   
>   	/* glob each piece */
>   	gargv[0] = argv[0];
> ! 	for (gargc = argc = 1; argv[argc] && gargc < (MAXGLOBARGS-1); argc++) {
>   		glob_t gl;
>   		int flags = GLOB_BRACE|GLOB_NOCHECK|GLOB_QUOTE|GLOB_TILDE;
>   
> --- 95,101 ----
>   
>   	/* glob each piece */
>   	gargv[0] = argv[0];
> ! 	for (gargc = argc = 1; argv[argc] && gargc < (MAXGLOBARGS-1) && argc < MAXUSRARGS; argc++) {
>   		glob_t gl;
>   		int flags = GLOB_BRACE|GLOB_NOCHECK|GLOB_QUOTE|GLOB_TILDE;
> ============================== cut here ================================
>   
>   See the source code to understand why previous patch was incomplete -
> it's easy...
>   BTW, wu-ftpd latest beta (13) still can be killed in this way... although
> wu-ftpd's maintainer was informed by me about 3 monthes ago.
> 
> With best regards, Vadim.
> 
> P.S. to test ftpd, do the following:
> 
> telnet your.host 21
> user ftp (or your userid, if you have no anonymous ftp)
> pass ftp@ (or your password)
> list x x x x x x x x x x x ... (around 3 lines will be enough ;)
> 
> Bugged ftpdwill die here - "Connection closed by foreigh host".
> Now look for core dump, extract password, start your Crack :)
> --------------------------------------------------------------------------
> Vadim Kolontsov                                          SysAdm/Programmer 
> Tver Regional Center of New Information Technologies          Networks Lab
> 
>