Subject: Bounce attack question(again)

From: [email-masked]
Date: Fri, 19 Dec 1997 09:00:34 -0500 (EST)

I saw some postings about 2 weeks back, but I don't think they
were talking about this advisory. Can anyone shed light on whether
this applies across the board or was it fixed in the B13 version

Thanks in advance

Doug

> 
> Caldera Security Advisory SA-1997.31: Additional Vulnerabilities in wu-ftpd
> 
> Original report date:	11-Dec-1997
> RPM build date:		12-Dec-1997
> Advisory issue date:	16-Dec-1997
> 
> Topic: Additional Vulnerabilities in wu-ftpd 2.4.2 beta 15
> 
> 
> I. Problem Description
> 
> 	This document summarizes additional vulnerabilities in the
> 	wu-ftpd 2.4.2 beta 15 FTP server not covered by CERT Advisory
> 	CA-97.27 - "FTP_bounce".  The list of affected platforms may not
> 	be limited to systems running under Linux.
> 
> 
> II. Impact
> 
> 	Under certain circumstances wu-ftpd 2.4.2 beta 15 allows a remote
> 	user to open a connection to any service on a server running the
> 	vulnerable version of wu-ftpd.  Under Linux, the connection will be
> 	established via the loopback interface which could bypass access
> 	controls that assume that connections can be established only via
> 	Ethernet, PPP or SLIP interfaces.  Other types of exploits are
> 	possible.
> 
> 	This problem was present on the following OpenLinux releases:
> 
> 		Base 1.0
> 		Lite 1.1
> 		Base 1.1
> 		Standard 1.1
> 
> 	To determine if you are affected and need this update execute the
> 	following:
> 
> 		rpm -q wu-ftpd
> 
> 	If the results show wu-ftpd-2.4.2b15-4 or earlier then you will need
> 	to update.
> 
> 	NOTE: The problem described in CERT Advisory CA-97.27 suggests
> 	using wu-ftpd 2.4.2 beta 15.  Versions of OpenLinux prior to 1.2
> 	included wu-ftpd release 2.4.2 beta 13 or earlier.  However,
> 	this should not be a problem if Caldera Security Advisory
> 	SA-1997.27 has already been applied since it recommends that
> 	wu-ftpd-2.4.2b15-4 be installed.  But the version of wu-ftpd 2.4.2
> 	beta 15 described in this document (wu-ftpd-2.4.2b15-5) contains
> 	*additional* security fixes.
> 
> 
> III. Solution
> 
> 	The proper solution is to install the new wu-ftpd package.
> 	This package is located on Caldera's FTP server (ftp.caldera.com):
> 
> 	The binary RPM can be obtained at:
> 	ftp://ftp.caldera.com/pub/openlinux/updates/1.1/current/RPMS
> 
> 	The source RPM can be obtained at:
> 	ftp://ftp.caldera.com/pub/openlinux/updates/1.1/current/SRPMS
> 
> 	All that is required to do to install the fix is the following:
> 
> 		rpm -U wu-ftpd-2.4.2b15-5.i386.rpm
> 
> 	The MD5 checksums (from the "md5sum" command) for these packages are:
> 
> 	1ce8038acc06eb200e87f2c8024df633  wu-ftpd-2.4.2b15-5.i386.rpm
> 	e81777eae4b6631fd3a9a238bd5da0be  wu-ftpd-2.4.2b15-5.src.rpm
> 
> 
> IV. References / Credits
> 
> 	This vulnerability was discovered and fixed by Olaf Kirch (email:
> 	[email-masked]).  Other Linux vendors and CERT have been apprised
> 	of this vulnerability.	Time is being given to other vendors
> 	to release their fixes before more details will be published.
> 	According to its maintainer, Stan Barber, release wu-ftpd 2.4.2
> 	Beta 16 is expected on or before 25-Dec-1997.
> 
> 	The CERT Coordination Center is located at:
> 
> 		http://www.cert.org
> 
> 	CERT Advisory CA-97.27: "FTP Bounce" (10-Dec-1997):
> 
> 		http://www.cert.org/pub/advisories/1997/CA-97.27.FTP_bounce.html
> 
> 	CERT Tech Tip "Problems With The FTP PORT Command" (10-Dec-1997):
> 
> 		ftp://ftp.cert.org/pub/tech_tips/FTP_PORT_attacks
> 	
> 	White Paper: "The FTP Bounce Attack" (12-Jul-1995):
> 
> 		ftp://avian.org/random/ftp-attack
> 
> 	Caldera Security Advisory SA-1997.27: "Vulnerability in wu-ftpd":
> 
> 		http://www.caldera.com/tech-ref/security/SA-1997.27.html
> 
> 	This advisory and other Caldera security resources are located at:
> 
> 		http://www.caldera.com/tech-ref/security/
> 
> 	This Security Alert closes Caldera internal problem report #1361.

-- 
Doug Courtney
[email-masked]
(732)576-5572