Subject: vulnerability exploit in wu-ftpd

From: Larry Deni <[email-masked]>
Date: Thu, 24 Apr 1997 15:43:59 -0400 (EDT)

Recently, we were attacked by an individual who was in posession of a copy
of a unix shell script which exploits a hole in wu-ftpd.  This is *not* the
same vulnerability as described in CERT advisory CA-95:16.wu-ftpd.vul, which
refers to a misconfiguration of _PATH_EXECPATH.  Our _PATH_EXECPATH is 
configured correctly.

I've just now subscribed to this mailing list, so please forgive my
ignorance of previously discussed issues.

The host which was attacked is a Sun Ultra running Solaris 2.5.1.  The 
version of wu-ftpd is wu-2.4(4) which was compiled by us on 13-aug-1996 
from sources which were available around 8-may-1996 from the wuarchive site.

The perpetrator had a script named "over" which had the capability of 
overwriting any file on the system.  Some header comments from "over"...

# exploit a bug in wu-ftpd to create a file anywhere on the filesystem
#  - files that already exist will be overwritten, but they won't
#    be writable.
#
# tested under Solaris 2.5
#
# James Abendschan  [email-masked]  16 Oct 1996
#

I will not release the details of the script for the usual security reasons.
The perpetrator either maliciously or stupidly overwrote the passwd file
on this unix host, rendering the system inaccessible and causing about 
a half day's loss of service to the campus while we traced through logs and
directories discovering what had been done and what had been damaged.

My questions are directed mainly to the maintainers of the wu-ftpd software:

  1.  Is this a known bug?
  2.  If known, has it been fixed in the current 2.4 patch release?

Thanks very much.
--Larry Deni
  Canisius College, Buffalo, NY
  [email-masked]

---

From: Phil Poole <[email-masked]>
Date: Thu, 24 Apr 1997 16:03:05 -0400 (EDT)

Larry,

	I must profess that without seeing the details of
	the exploit it would be difficult to tell if the
	exploit had been addressed in a current release.

	The current release of wu-ftpd is 2.4-beta12 which
	has a rather large number of fixes from just the
	2.4 release.

	Can you check and see if you are running the or one
	of the latest beta wu-ftp versions ?

	I would be interested in double checking it since my 
	systems are Solaris 2.X running Wu-ftpd 2.4.X

TIA

Later.

--
       Phil Poole	| Unix Systems Administrator
     [email-masked]	| Frederick Biomedical SuperComputing Center
      (301) 846-5721	| Frederick MD, 21702

---

From: Andy Ellsworth <[email-masked]>
Date: Thu, 24 Apr 1997 15:18:49 -0500 (CDT)

> refers to a misconfiguration of _PATH_EXECPATH.  Our _PATH_EXECPATH is 

If this is *not* a CERT-advised exploit, have you reported it to them?
I'm sure they could tell you if it's been reported before, and if so, what
fixes are available.

+----------------------------------------------------------------------------+
| Andy Ellsworth  |  [email-masked] |  Admin/Cyberdiplomat, Wuarchive    |
+----------------------------------------------------------------------------+

---

From: Dan Foster <[email-masked]>
Date: Thu, 24 Apr 1997 16:43:50 -0400 (EDT)

Hot Diggety! Phil Poole was rumored to have said...
> 	has a rather large number of fixes from just the

Not to nitpick, split hairs, split beer atoms (like Weird Al Yankovic), or 
anything, but...

actually, latest is 2.4.2-beta 13. Beta 13 has been out for some time now.

-Dan Foster
Internet: [email-masked]

---

From: Alain Magloire <[email-masked]>
Date: Thu, 24 Apr 1997 17:20:17 -0400 (EDT)

Salut A Vous, O Grand Manitou Larry Deni !!

> of a unix shell script which exploits a hole in wu-ftpd.  This is *not* the
....
> overwriting any file on the system.  Some header comments from "over"...
....
> I will not release the details of the script for the usual security reasons.

This *ALWAYS* drives me off the wall.
Security through obscurity will get you nowhere

This ain't a cracker list, if you don't want to release any details
then why posting ?

Seeing this crap ... hmmmmm

> My questions are directed mainly to the maintainers of the wu-ftpd software:

then post to the maintainer, read the FAQ to get the address
Is name is Mr Stan Barber.

>   2.  If known, has it been fixed in the current 2.4 patch release?

I believe what you are reporting is the fact that
wu-ftpd can core dump and it will core dump as root.
And of course it will follow any symbolic links

the easiest way to make wu-ftpd core dump

is to issue a PASV command without doing the user/pass first
ex:

telnet locahost ftp
200-
200- ....

pasv

the server will core dump

if you know where just make a symlink to /etc/passwd

or
the bug in ftp_popen() if the argument is over 100

do something like

ls a a a a a a a .... over 100

or

site exec index a a a a a a a a a a a a a  over a 100 args

the server will crash also

All those issues and more that you are not aware
where corrected in the beta release's

Just upgrade the server

> Thanks very much.

Post the details or don't bother
Security is a big concern to us, no need to raise
are blood pressure with rumors. We have enough with sendmail

-- 
au revoir, alain
----
Aussi haut que l'on soit assis, on est toujours assis que sur son cul !!!

---

From: Chris Marshall <[email-masked]>
Date: Fri, 25 Apr 1997 00:26:20 +0100

> Security through obscurity will get you nowhere

Well, yes, and no.
 
> This ain't a cracker list

How do *you* know?

How do you know that I'm *not* a cracker? I didn't have to present
and credentials to join this list, and given that wu-ftpd is a 
very widely used piece of software, and has been a vulnerable
piece of software in the past, you can bet your best boots that
there are some, er, interested parties on this list. (hI d00dz :)

If I were a clued up cracker, I'd be the first to subscribe to 
this list, as many web server lists as possible, bugtraq, the
CERT list, the greatcircle firewall list, and so on. Then I'd 
just *lurk*, thanks very much :-)

Disclaimer: this message is worth just $0.02

--Chris

---

From: Hristo Kirov <[email-masked]>
Date: Fri, 25 Apr 1997 17:56:20 +0300

Hi,
where I can find wu-ftpd2.4.2-beta13?
-- 
    _/    _/    _/_/_/    _/_/_/      Hristo N. Kirov
   _/    _/  _/        _/             http://www.uni-sofia.bg/~hristo
  _/    _/  _/        _/              mailto:[email-masked] 
 _/    _/  _/        _/               ico  on  IRC,  Chanel: #bulgaria
  _/_/      _/_/_/    _/_/_/          (359 2)625 657 9, (359 2)963 328 2

---

From: Dan Foster <[email-masked]>
Date: Fri, 25 Apr 1997 12:08:25 -0400 (EDT)

Hot Diggety! Hristo Kirov was rumored to have said...
> where I can find wu-ftpd2.4.2-beta13?

The usual place, which is ftp.academ.com in /pub/wu-ftpd/private

-Dan Foster