Vulnerability Note VU#258721

Overview

Various FTP client implementations do not correctly handle files whose name begins with the "|" (pipe) character.

Description

Most FTP clients include a feature in which the remote filename is used as the local filename in a GET (RETR) operation. For example, many FTP clients support syntax similar to the following: ftp> get file.name local.name which causes the remote file file.name to be retrieved to the local client and named local.name. In a typical FTP client, if you specify ftp> get file.name the client will assume a local name of file.name. Furthermore, many FTP clients support an often undocumented feature that allows the contents of a remote file to be piped through a local command. For example, ftp> get README | more will often cause the contents of the remote file README to be piped through the local more command. This is a very widely known and often used feature, but is not well documented. Note specifically that the presence of the pipe character (|) means that the second argument to the get command is not a filename, but rather an indication to pass the contents of the remote filename through a command. Similar undocumented behavior is often present for the dash character (-), which causes the contents of the remote file to be sent to standard output. Some FTP clients with both features present a security risk. If the name of the remote file begins with a pipe character (|), and an FTP client relies on the default local filename, the contents of the file will be piped through a command based on the name of the remote file. Specifically, the command will be the name of the remote file without the leading pipe (|) character. For example, if the remote file is named |logger, with the contents hello, how are you an FTP command such as ftp> get |logger will, on a vulnerable FTP client, cause the contents of the file (hello, how are you) to be logged to your local system log, rather than creating a local file named |logger. In October of 1997, IBM's Emergency Response Service published a security advisory (ERS-SVA-E01-1997:009.1) detailing a vulnerability in the AIX FTP client. Quoting from ERS-SVA-E01-1997:009.1: The ftp client can be tricked into running arbitrary commands supplied by the remote server. When the remote file begins with a pipe symbol, the ftp client will process the contents of the remote file as a shell script. After IBM's Emergency Response Service published their bulletin, it was discovered that other vendors client FTP implementations were vulnerable as well. However, it appears not all implementations were actually fixed. Some discussion about this problem is available at http://online.securityfocus.com/bid/396/discussion/ In 2003, this problem was discovered to have affected FTP clients that weren't fixed when the problem was originally discovered, most notably including the FTP client from MIT, which is redistributed by some operating system vendors such as Red Hat. The list of vendors below includes as "vulnerable" vendors who fixed their FTP clients in the 1997 time frame. Follow the links to individual vendor records for more detailed information.

Impact

A malicious server can execute arbitrary code on a victim FTP client.

Solution

Apply a vendor-supplied patch.

Systems Affected (Learn More)

Vendor	Status	Date Notified	Date Updated
MIT Kerberos Development Team	Affected	17 Jan 2003	24 Jan 2003
Red Hat Inc.	Affected	16 Jan 2003	03 Feb 2003
Sun Microsystems Inc.	Affected	16 Jan 2003	24 Jan 2003
Xerox Corporation	Affected	16 Jan 2003	30 May 2003
Apple Computer Inc.	Not Affected	16 Jan 2003	20 Jan 2003
Cisco Systems Inc.	Not Affected	16 Jan 2003	24 Jan 2003
Cray Inc.	Not Affected	16 Jan 2003	16 Jan 2003
FreeBSD	Not Affected	16 Jan 2003	21 Jan 2003
Hewlett-Packard Company	Not Affected	16 Jan 2003	28 Jan 2003
Hitachi	Not Affected	16 Jan 2003	24 Jan 2003
IBM	Not Affected	16 Jan 2003	16 Jan 2003
Ingrian Networks	Not Affected	16 Jan 2003	17 Jan 2003
Juniper Networks	Not Affected	16 Jan 2003	20 Jan 2003
MontaVista Software	Not Affected	16 Jan 2003	20 Jan 2003
NetBSD	Not Affected	16 Jan 2003	24 Jan 2003

If you are a vendor and your product is affected, let us know.View More »

CVSS Metrics (Learn More)

Group	Score	Vector
Base	N/A	N/A
Temporal	N/A	N/A
Environmental	N/A	N/A

References

• http://online.securityfocus.com/bid/396
• http://www.iss.net/security_center/static/605.php
• http://online.securityfocus.com/advisories/1448

Credit

Thanks to Fozzy of The Hackademy Audit Project for bringing this issue to our attention.

This document was written by Ian A. Finlay & Shawn V. Hernan.

Other Information

• CVE IDs: CVE-1999-0097
• Date Public: 27 Oct 97
• Date First Published: 24 Jan 2003
• Date Last Updated: 05 Feb 2003
• Severity Metric: 17.69
• Document Revision: 49