-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===============================================================================
>>                                                      CERT-NL, 01-Mar-2000 <<
>> All CERT-NL information has been moved to http://cert.surfnet.nl.  Links  <<
>> to CERT-NL information contained in this advisory are therefore outdated. <<
>>                                                                           <<
>> CERT-NL also has stopped the CERT-CC-Mirror service.  Due to this the     <<
>> links to the CERT-CC mirror are obsolete. Visit the CERT-CC site for the  <<
>> complete CERT-CC advisory texts:                     http://www.cert.org  <<
===============================================================================
===============================================================================
Security Advisory                                                       CERT-NL
===============================================================================
Author/Source : CERT-NL (Erik-Jan Bos)                      Index  :    S-94-10
Distribution  : World                                       Page   :          1
Classification: External                                    Version:      Final
Subject       : ftpd Vulnerabilities                        Date   :  15-Apr-94
===============================================================================


CERT-NL has received information concerning two vulnerabilities in some
ftpd implementations. The first is a vulnerability with the SITE EXEC
command feature of the FTP daemon (ftpd) found in versions of ftpd that
support the SITE EXEC feature. This vulnerability allows local or
remote users to gain root access. The second vulnerability involves a
race condition found in the ftpd implementations listed in Section I.
below. This vulnerability allows local users to gain root access.

Sites using these implementations are vulnerable even if they do not
support anonymous FTP.

As these vulnerabilities are widely known, we strongly recommend that
any site running a version of ftpd listed below take steps to
immediately upgrade or disable their FTP daemon. Also potentially at
risk are sites whose ftpd is derived from the DECWRL or wuarchive ftpd
code containing the SITE EXEC feature.

For additional information or assistance, contact the developer or
vendor of your ftpd implementation.

If we receive additional information relating to this advisory, we will
place it, along with any clarifications, in a README file available by
anonymous FTP from info.cert.org (e.g.,
/pub/cert_advisories/CA-94:xx.README).  We encourage you to check our
README files regularly for updates on advisories that relate to your
site.

- -----------------------------------------------------------------------------

I.   Description

     There is a vulnerability in the SITE EXEC command feature of
     ftpd that allows any remote or local user to obtain root access.
     There is also a vulnerability due to a race condition in these
     implementations. 

     Versions known to be vulnerable to these problems are:
          wuarchive ftpd versions 2.0-2.3 (version 2.2 patched the
               SITE EXEC problem, but not the race condition)
          DECWRL ftpd versions prior 5.93
          BSDI ftpd version 1.1 prior to patch 5

     The SITE EXEC vulnerability affects your ftpd only if the SITE
     EXEC command feature has been explicitly activated at your site.
     This functionality is not activated by default.  Sites that have
     not enabled the SITE EXEC feature are not at risk from this
     vulnerability.  However, since the race condition does not have
     an easily applied workaround, CERT recommends that you upgrade to
     one of the versions listed below.

II.  Impact

     Anyone (remote or local) can gain root access on a host running a
     vulnerable FTP daemon.  Support for anonymous FTP is not required
     to exploit this vulnerability.


III. Solution

     Affected sites can solve both of these problems by upgrading to
     the latest version of ftpd. These versions are listed below. Be
     certain to verify the checksum information to confirm that you
     have retrieved a valid copy.

     If you cannot install the new version in a timely manner, you
     should disable FTP service until you have corrected this problem.
     It is not sufficient to disable anonymous FTP.  You must disable
     the FTP daemon.

     For wuarchive ftpd, you can obtain version 2.4 via anonymous
     FTP from wuarchive.wustl.edu, in the "/packages/wuarchive-ftpd"
     directory.  If you are currently running version 2.3, a patch
     file is available.


                        BSD        SVR4         
     File               Checksum   Checksum    MD5 Digital Signature
     -----------------  --------   ---------   --------------------------------
     wu-ftpd-2.4.tar.Z  38213  181  20337 362  cdcb237b71082fa23706429134d8c32e
     patch_2.3-2.4.Z    09291    8  51092  16  5558a04d9da7cdb1113b158aff89be8f

     For DECWRL ftpd, sites can obtain version 5.93 via anonymous FTP
     from gatekeeper.dec.com in the "/pub/misc/vixie" directory.

                        BSD        SVR4         
     File               Checksum   Checksum    MD5 Digital Signature
     -----------------  --------   --------- --------------------------------
     ftpd.tar.gz        38443  60  1710 119  ae624eb607b4ee90e318b857e6573500

     For BSDI systems, patch 005 should be applied to version 1.1 of
     the BSD/386 software.  You can obtain the patch file via
     anonymous FTP from ftp.bsdi.com in the "/bsdi/patches-1.1"
     directory.

                        BSD        SVR4         
     File               Checksum   Checksum    MD5 Digital Signature
     -----------------  --------   ---------   --------------------------------
     BU110-005          35337 272  54935 543   1f454d4d9d3e1397d1eff0432bd383cf

- ---------------------------------------------------------------------------
The CERT Coordination Center wishes to thank Neil Woods and Karl Strickland 
for finding and reporting the wustl FTP daemon bug.  We also wish to thank 
Bryan O'Connor and Chris Myers of Washington University in St. Louis,
Paul Vixie of Vixie Enterprises, and Tony Sanders of BSDI for their 
invaluable assistance in resolving this problem.
- ---------------------------------------------------------------------------

CERT-NL wishes to thank The CERT Coordination Center for bringing this
information to our attention.

==============================================================================
CERT-NL is the Computer Emergency Response Team for SURFnet customers. SURFnet
is the Dutch network for educational, research and related institutes. CERT-NL
is a member of the Forum of Incident Response and Security Teams (FIRST).

All CERT-NL material is available under:
  http://cert.surfnet.nl/

In case of computer or network security problems please contact your local
CERT/security-team or CERT-NL  (if your institute is NOT a SURFnet customer
please address the appropriate (local) CERT/security-team).

CERT-NL is one/two hour(s) ahead of UTC (GMT) in winter/summer,
i.e. UTC+0100 in winter and UTC+0200 in summer (DST).

   Email:     cert-nl@surfnet.nl     ATTENDED REGULARLY ALL DAYS
   Phone:     +31 302 305 305        BUSINESS HOURS ONLY
   Fax:       +31 302 305 329        BUSINESS HOURS ONLY
   Snailmail: SURFnet bv
              Attn. CERT-NL
              P.O. Box 19035
              NL - 3501 DA  UTRECHT
              The Netherlands

NOODGEVALLEN:    06 22 92 35 64      ALTIJD BEREIKBAAR
EMERGENCIES : +31 6 22 92 35 64      ATTENDED AT ALL TIMES
CERT-NL'S EMERGENCY PHONENUMBER IS ONLY TO BE USED IN CASE OF EMERGENCIES:
THE SURFNET HELPDESK OPERATING THE EMERGENCY NUMBER HAS A *FIXED*
PROCEDURE FOR DEALING WITH YOUR ALERT AND WILL IN REGULAR CASES RELAY IT
TO CERT-NL IN AN APPROPRIATE MANNER. CERT-NL WILL THEN CONTACT YOU.
===============================================================================

-----BEGIN PGP SIGNATURE-----
Version: PGP 6.5.1i

iQA/AwUBOL6WEzSYjBqwfc9jEQISSQCcCICE/2PtAdaZp3EqzrmKU69flEsAoKwE
99mEXrlRS+QfMSzAfuetd0jV
=H8Mm
-----END PGP SIGNATURE-----