Subject: Security leak in VR6 patches

From: Bernhard Rosenkraenzer <[email-masked]>
Date: Wed, 2 Sep 1998 16:00:50 +0200 (CEST)

There is a security leak in the VR6 patches, affecting noretrieve.

The line
  wu_realpath (name, realname, chroot_path);

in the beginning of checknoretrieve() should read
  wu_realpath(name, realname, NULL);

Otherwise, a "noretrieve /etc/passwd" can be ignored by doing
cd /etc
get passwd

This behavior is fixed in BeroFTPD 1.1.9.

LLaP
bero

-- 
Windows 98 supports real multitasking - it can boot and crash simultaneously.
***
Anyone sending unwanted advertising e-mail to this address will be charged
$25 for network traffic and computing time. By extracting my address from
this message or its header, you agree to these terms.

---

From: Gregory A Lundberg <[email-masked]>
Date: Wed, 2 Sep 1998 11:28:47 -0400 (EDT)

> This behavior is fixed in BeroFTPD 1.1.9.

This will be in VR7

*** extensions.c.orig	Wed Aug 26 10:53:29 1998
--- extensions.c	Wed Sep  2 11:27:31 1998
***************
*** 1346,1352 ****
    if (name == (char *)NULL || *name == '\0')
      return 0; 
  
!   realpath (name, realname, chroot_path);
  
     while (getaclentry("noretrieve", &entry)) {
          if (ARG0 == (char *)NULL)
--- 1346,1352 ----
    if (name == (char *)NULL || *name == '\0')
      return 0; 
  
!   realpath (name, realname, NULL);
  
     while (getaclentry("noretrieve", &entry)) {
          if (ARG0 == (char *)NULL)

----

Gregory A Lundberg		Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195

---

From: Gregory A Lundberg <[email-masked]>
Date: Wed, 2 Sep 1998 11:36:35 -0400 (EDT)

> This behavior is fixed in BeroFTPD 1.1.9.

On second thought, maybe I won't fix that.  The etc/passwd he's retrieving
is not the system password file, but the local copy in the chroot'd area
which (at least for the base release, I don't know what he's doing in
BeroFTPD) should NOT contain any security information such as passwords.

It is my belief that the notreieve directive should use absolute file
names.  So, if he has a /virt/etc/passwd file containing sensistive
information, he should make THAT file noretrieve.

----

---

From: Bernhard Rosenkraenzer <[email-masked]>
Date: Wed, 2 Sep 1998 18:53:18 +0200 (CEST)

> information, he should make THAT file noretrieve.

You're right here - it's probably sufficient to mark in the docs that the
filenames must be absolute.

Then again, it also makes sense to have a noretrieve directive for
relative paths, so I can for example say
  noretrieve /etc/
and it effects the /etc directory in all the virtual hosts... (This makes
sense, of course, only with the combination of VR6 and newvirt - or
BeroFTPD which contains both of them anyway).
On systems with 200 virtual hosts, that's far easier than having 200
separate noretrieve /serverx/etc files...

I'm thinking about adding an option "absolute|relative" to the noretrieve
directive, which should combine the good sides of both approaches.

LLaP
bero

---

From: Gregory A Lundberg <[email-masked]>
Date: Wed, 2 Sep 1998 13:29:50 -0400 (EDT)

> directive, which should combine the good sides of both approaches.

Excellent idea, and it should only take a few seconds to add.  I'll put it
in VR7.

----