Bugtraq mailing list archives
[ GLSA 200611-05 ] Netkit FTP Server: Privilege escalation
From: Raphael Marichez <falco () gentoo org>
Date: Fri, 10 Nov 2006 15:24:07 +0100
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200611-05 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: High Title: Netkit FTP Server: Privilege escalation Date: November 10, 2006 Bugs: #150292 ID: 200611-05 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== An incorrect seteuid() call could allow an FTP user to access some files or directories that would normally be inaccessible. Background ========== net-ftp/ftpd is the Linux Netkit FTP server with optional SSL support. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 net-ftp/ftpd < 0.17-r4 >= 0.17-r4 Description =========== Paul Szabo reported that an incorrect seteuid() call after the chdir() function can allow an attacker to access a normally forbidden directory, in some very particular circumstances, for example when the NFS-hosted targetted directory is not reachable by the client-side root user. Additionally, some potentially exploitable unchecked setuid() calls were also fixed. Impact ====== A local attacker might craft his home directory to gain access through ftpd to normally forbidden directories like /root, possibly with writing permissions if seteuid() fails and if the ftpd configuration allows that. The unchecked setuid() calls could also lead to a root FTP login, depending on the FTP server configuration. Workaround ========== There is no known workaround at this time. Resolution ========== All Netkit FTP Server users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=net-ftp/ftpd-0.17-r4" References ========== [ 1 ] CVE-2006-5778 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5778 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-200611-05.xml Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security () gentoo org or alternatively, you may file a bug at http://bugs.gentoo.org. License ======= Copyright 2006 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5
Attachment:
_bin
Description:
Current thread:
- [ GLSA 200611-05 ] Netkit FTP Server: Privilege escalation Raphael Marichez (Nov 10)