Vulnerability Note VU#405348

ProFTPD fails to properly handle newline characters when transferring files in ASCII mode

Overview

ProFTPD is a popular free File Transfer Protocol (FTP) server package. A vulnerability in its handling of files transferred in ASCII mode can allow an attacker to compromise the system running the server.

I. Description

The File Transfer Protocol (FTP) described in RFC959 defines operations for several data types, including ASCII. For this mode of operation, RFC959 states:

... The sender converts the data from an internal character representation to the standard 8-bit NVT-ASCII representation (see the Telnet specification). The receiver will convert the data from the standard form to his own internal form.

In accordance with the NVT standard, the <CRLF> sequence should be used where necessary to denote the end of a line of text. (See the discussion of file structure at the end of the Section on Data Representation and Storage.)...

Researchers at ISS have discovered a flaw in the way that the ProFTP server handles this conversion that results in a vulnerability. According to ISS's bulletin:

A vulnerability exists in the ProFTPD server that can be triggered by remote attackers when transferring files from the FTP server in ASCII mode. The attacker must have the ability to upload a file to the server, and then attempt to download the same file to trigger the vulnerability.

The vulnerability occurs when a file is being transferred in ASCII mode. During a transfer of this type, file data is examined in 1024 byte chunks to check for newline (\n) characters. The translation of these newline characters is not handled correctly, and a buffer overflow can manifest if ProFTPD parses a specially crafted file.

II. Impact

A remote attacker may be able to execute arbitrary code on the vulnerable server with elevated privileges.

NOTE: Exploits for this vulnerability are publicly available and the CERT/CC has received reports of active reconnaissance for vulnerable systems.

III. Solution

Apply a patch from the vendor

Patches have been released to address this vulnerability. Please see the vendors section of this document for more details.
Workarounds

Disable uploads in the ProFTP daemon. Since exploitation of the vulnerability requires an attacker to place a specially crafted file on the vulnerable system, disabling uploads will prevent them from being able to do this via FTP. Note that this step will not prevent exploitation if the attacker is able to upload the file into the FTP area via some other means, such as ssh or a web form.

Systems Affected

Vendor	Status	Date Notified
Conectiva Linux	Vulnerable	7-Oct-2003
Gentoo Linux	Vulnerable	7-Oct-2003
MandrakeSoft	Vulnerable	7-Oct-2003
OpenPKG	Vulnerable	7-Oct-2003
ProFTPD	Vulnerable	7-Oct-2003
Slackware	Vulnerable	7-Oct-2003
Trustix Secure Linux	Vulnerable	7-Oct-2003
TurboLinux	Vulnerable	7-Oct-2003

References

http://xforce.iss.net/xforce/alerts/id/154
http://www.secunia.com/advisories/9829/

Credit

This vulnerability was discovered and researched by Mark Dowd from Internet Security Systems' (ISS) X-Force. The information was originally published by ISS.

This document was written by Chad R Dougherty based on information published by ISS.

Other Information

Date Public:	2003-09-23
Date First Published:	2003-10-29
Date Last Updated:	2003-10-29
CERT Advisory:
CVE-ID(s):	CAN-2003-0831
NVD-ID(s):	CAN-2003-0831
US-CERT Technical Alerts:
Metric:	35.27
Document Revision:	9

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Get Adobe Reader