Vulnerability Note VU#258721

Various FTP clients fail to account for pipe (|) characters in default file names

Original Release date: 24 Jan 2003 | Last revised: 05 Feb 2003

Overview

Various FTP client implementations do not correctly handle files whose name begins with the "|" (pipe) character.

Description

Most FTP clients include a feature in which the remote filename is used as the local filename in a GET (RETR) operation. For example, many FTP clients support syntax similar to the following:

    ftp> get file.name local.name

which causes the remote file file.name to be retrieved to the local client and named local.name. In a typical FTP client, if you specify
    ftp> get file.name
the client will assume a local name of file.name. Furthermore, many FTP clients support an often undocumented feature that allows the contents of a remote file to be piped through a local command. For example,
    ftp> get README | more
will often cause the contents of the remote file README to be piped through the local more command. This is a very widely known and often used feature, but is not well documented. Note specifically that the presence of the pipe character (|) means that the second argument to the get command is not a filename, but rather an indication to pass the contents of the remote filename through a command. Similar undocumented behavior is often present for the dash character (-), which causes the contents of the remote file to be sent to standard output.

Some FTP clients with both features present a security risk. If the name of the remote file begins with a pipe character (|), and an FTP client relies on the default local filename, the contents of the file will be piped through a command based on the name of the remote file. Specifically, the command will be the name of the remote file without the leading pipe (|) character. For example, if the remote file is named |logger, with the contents
    hello, how are you
an FTP command such as
    ftp> get |logger
will, on a vulnerable FTP client, cause the contents of the file (hello, how are you) to be logged to your local system log, rather than creating a local file named |logger.

In October of 1997, IBM's Emergency Response Service published a security advisory (ERS-SVA-E01-1997:009.1) detailing a vulnerability in the AIX FTP client. Quoting from ERS-SVA-E01-1997:009.1:
    The ftp client can be tricked into running arbitrary commands supplied by the remote server. When the remote file begins with a pipe symbol, the ftp client will process the contents of the remote file as a shell script.
After IBM's Emergency Response Service published their bulletin, it was discovered that other vendors client FTP implementations were vulnerable as well. However, it appears not all implementations were actually fixed. Some discussion about this problem is available at

http://online.securityfocus.com/bid/396/discussion/

In 2003, this problem was discovered to have affected FTP clients that weren't fixed when the problem was originally discovered, most notably including the FTP client from MIT, which is redistributed by some operating system vendors such as Red Hat. The list of vendors below includes as "vulnerable" vendors who fixed their FTP clients in the 1997 time frame. Follow the links to individual vendor records for more detailed information.

Impact

A malicious server can execute arbitrary code on a victim FTP client.

Solution

Apply a vendor-supplied patch.

Systems Affected (Learn More)

VendorStatusDate NotifiedDate Updated
MIT Kerberos Development TeamAffected17 Jan 200324 Jan 2003
Red Hat Inc.Affected16 Jan 200303 Feb 2003
Sun Microsystems Inc.Affected16 Jan 200324 Jan 2003
Xerox CorporationAffected16 Jan 200330 May 2003
Apple Computer Inc.Not Affected16 Jan 200320 Jan 2003
Cisco Systems Inc.Not Affected16 Jan 200324 Jan 2003
Cray Inc.Not Affected16 Jan 200316 Jan 2003
FreeBSDNot Affected16 Jan 200321 Jan 2003
Hewlett-Packard CompanyNot Affected16 Jan 200328 Jan 2003
HitachiNot Affected16 Jan 200324 Jan 2003
IBMNot Affected16 Jan 200316 Jan 2003
Ingrian NetworksNot Affected16 Jan 200317 Jan 2003
Juniper NetworksNot Affected16 Jan 200320 Jan 2003
MontaVista SoftwareNot Affected16 Jan 200320 Jan 2003
NetBSDNot Affected16 Jan 200324 Jan 2003
If you are a vendor and your product is affected, let us know.View More »

CVSS Metrics (Learn More)

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A N/A

References

Credit

Thanks to Fozzy of The Hackademy Audit Project for bringing this issue to our attention.

This document was written by Ian A. Finlay & Shawn V. Hernan.

Other Information

  • CVE IDs: CVE-1999-0097
  • Date Public: 27 Oct 97
  • Date First Published: 24 Jan 2003
  • Date Last Updated: 05 Feb 2003
  • Severity Metric: 17.69
  • Document Revision: 49

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.