Vulnerability Note VU#258721

Various FTP clients fail to account for pipe (|) characters in default file names

Overview

Various FTP client implementations do not correctly handle files whose name begins with the "|" (pipe) character.

I. Description

Most FTP clients include a feature in which the remote filename is used as the local filename in a GET (RETR) operation. For example, many FTP clients support syntax similar to the following:

ftp> get file.name local.name

which causes the remote file file.name to be retrieved to the local client and named local.name. In a typical FTP client, if you specify

ftp> get file.name

the client will assume a local name of file.name. Furthermore, many FTP clients support an often undocumented feature that allows the contents of a remote file to be piped through a local command. For example,

ftp> get README | more

will often cause the contents of the remote file README to be piped through the local more command. This is a very widely known and often used feature, but is not well documented. Note specifically that the presence of the pipe character (|) means that the second argument to the get command is not a filename, but rather an indication to pass the contents of the remote filename through a command. Similar undocumented behavior is often present for the dash character (-), which causes the contents of the remote file to be sent to standard output.

Some FTP clients with both features present a security risk. If the name of the remote file begins with a pipe character (|), and an FTP client relies on the default local filename, the contents of the file will be piped through a command based on the name of the remote file. Specifically, the command will be the name of the remote file without the leading pipe (|) character. For example, if the remote file is named |logger, with the contents

hello, how are you

an FTP command such as

ftp> get |logger

will, on a vulnerable FTP client, cause the contents of the file (hello, how are you) to be logged to your local system log, rather than creating a local file named |logger.

In October of 1997, IBM's Emergency Response Service published a security advisory (ERS-SVA-E01-1997:009.1) detailing a vulnerability in the AIX FTP client. Quoting from ERS-SVA-E01-1997:009.1:

The ftp client can be tricked into running arbitrary commands supplied by the remote server. When the remote file begins with a pipe symbol, the ftp client will process the contents of the remote file as a shell script.

After IBM's Emergency Response Service published their bulletin, it was discovered that other vendors client FTP implementations were vulnerable as well. However, it appears not all implementations were actually fixed. Some discussion about this problem is available at

http://online.securityfocus.com/bid/396/discussion/

In 2003, this problem was discovered to have affected FTP clients that weren't fixed when the problem was originally discovered, most notably including the FTP client from MIT, which is redistributed by some operating system vendors such as Red Hat. The list of vendors below includes as "vulnerable" vendors who fixed their FTP clients in the 1997 time frame. Follow the links to individual vendor records for more detailed information.

II. Impact

A malicious server can execute arbitrary code on a victim FTP client.

III. Solution

Apply a vendor-supplied patch.

Systems Affected

Vendor	Status	Date Notified
Alcatel	Unknown	16-Jan-2003
Apple Computer Inc.	Not Vulnerable	20-Jan-2003
AT&T	Unknown	16-Jan-2003
Avaya	Unknown	16-Jan-2003
BSDI	Unknown	16-Jan-2003
Cisco Systems Inc.	Not Vulnerable	24-Jan-2003
Compaq Computer Corporation	Unknown	16-Jan-2003
Computer Associates	Unknown	16-Jan-2003
Conectiva	Unknown	16-Jan-2003
Cray Inc.	Not Vulnerable	16-Jan-2003
Data General	Unknown	16-Jan-2003
Debian	Unknown	16-Jan-2003
Engarde	Unknown	16-Jan-2003
F5 Networks	Unknown	16-Jan-2003
FreeBSD	Not Vulnerable	21-Jan-2003
Fujitsu	Unknown	16-Jan-2003
Hewlett-Packard Company	Not Vulnerable	28-Jan-2003
Hitachi	Not Vulnerable	24-Jan-2003
IBM	Not Vulnerable	16-Jan-2003
Ingrian Networks	Not Vulnerable	17-Jan-2003
Intel	Unknown	16-Jan-2003
Juniper Networks	Not Vulnerable	20-Jan-2003
Lachman	Unknown	16-Jan-2003
Lotus Software	Unknown	16-Jan-2003
Lucent Technologies	Unknown	16-Jan-2003
MandrakeSoft	Unknown	16-Jan-2003
Microsoft Corporation	Unknown	16-Jan-2003
MIT Kerberos Development Team	Vulnerable	24-Jan-2003
MontaVista Software	Not Vulnerable	20-Jan-2003
Multi-Tech Systems Inc.	Unknown	16-Jan-2003
Multinet	Unknown	16-Jan-2003
NEC Corporation	Unknown	16-Jan-2003
NetBSD	Not Vulnerable	24-Jan-2003
Netscreen	Not Vulnerable	24-Jan-2003
Network Appliance	Not Vulnerable	20-Jan-2003
NeXT	Unknown	16-Jan-2003
Nokia	Not Vulnerable	24-Jan-2003
Nortel Networks	Unknown	16-Jan-2003
OpenBSD	Unknown	16-Jan-2003
Openwall GNU/*/Linux	Not Vulnerable	20-Jan-2003
Oracle Corporation	Unknown	16-Jan-2003
Red Hat Inc.	Vulnerable	3-Feb-2003
Redback Networks Inc.	Unknown	16-Jan-2003
Riverstone Networks	Not Vulnerable	17-Jan-2003
Sequent	Unknown	16-Jan-2003
SGI	Unknown	16-Jan-2003
Sony Corporation	Unknown	16-Jan-2003
Sun Microsystems Inc.	Vulnerable	24-Jan-2003
SuSE Inc.	Unknown	16-Jan-2003
The SCO Group (SCO Linux)	Unknown	16-Jan-2003
The SCO Group (SCO UnixWare)	Unknown	16-Jan-2003
Unisys	Unknown	16-Jan-2003
Wind River Systems Inc.	Unknown	16-Jan-2003
Wirex	Unknown	16-Jan-2003
Xerox Corporation	Vulnerable	30-May-2003

References

http://online.securityfocus.com/bid/396
http://www.iss.net/security_center/static/605.php
http://online.securityfocus.com/advisories/1448

Credit

Thanks to Fozzy of The Hackademy Audit Project for bringing this issue to our attention.

This document was written by Ian A. Finlay & Shawn V. Hernan.

Other Information

Date Public:	97-10-27
Date First Published:	2003-01-24
Date Last Updated:	2003-02-05
CERT Advisory:
CVE-ID(s):	CVE-1999-0097
NVD-ID(s):	CVE-1999-0097
US-CERT Technical Alerts:
Metric:	17.69
Document Revision:	49

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Get Adobe Reader