Vulnerability Note VU#743092

realpath(3) function contains off-by-one buffer overflow

Overview

A function originally derived from 4.4BSD, realpath(3), contains a vulnerability that may permit a malicious user to gain root access to the server. This function was derived from the FreeBSD 3.x tree. Other applications and operating systems that use or were derived from this code base may be affected. This problem was originally reported to affect WU-FTPd. It has been discoved to affect various BSD implementations as well.

I. Description

Several BSD operating systems and WU-FTPd are vulnerable to an off-by-one buffer overflow vulnerability. The vulnerable code is in the realpath(3) function and exploitation may be made through the use of several commands. Details of the vulnerability related to WU-FTPd can be found in the security advisory released by isec.pl. According to their advisory:

Linux 2.2.x and some early 2.4.x kernel versions defines PATH_MAX to be
4095 characters, thus only wu-ftpd binaries compiled on 2.0.x or later 2.4.x
kernels are affected.

Upon further investigation, it has been determined that the vulnerable WU-FTPd function was derived from code in the FreeBSD 3.x tree. This code appears to have come from 4.4BSD. Therefore, other applications and operating systems that use or were derived from this code base may be affected. This problem was originally reported to affect WU-FTPd. It has been discoved to affect various BSD implementations as well.

II. Impact

A malicious user may be able to exploit this vulnerability to gain elevated privileges on the vulnerable server. Malicious users may be authenticated to the server, or may be an anonymous user with write access to the server.

III. Solution

Please check the Systems Affected section for patches and upgrades to resolve this issue.

To help mitigate a remote attacker from exploiting this issue, and as a general practice, do not permit anonymous user to have write access to the server.

Systems Affected

Vendor	Status	Date Notified
Apple Computer Inc.	Vulnerable	15-Aug-2003
Conectiva	Vulnerable	1-Aug-2003
Cray Inc.	Not Vulnerable	4-Aug-2003
Debian	Vulnerable	1-Aug-2003
FreeBSD	Vulnerable	4-Aug-2003
Hewlett-Packard Company	Vulnerable	15-Aug-2003
IBM	Not Vulnerable	15-Aug-2003
Immunix	Vulnerable	15-Aug-2003
Ingrian Networks	Not Vulnerable	15-Aug-2003
MandrakeSoft	Vulnerable	31-Jul-2003
NetBSD	Vulnerable	4-Aug-2003
OpenBSD	Vulnerable	4-Aug-2003
Openwall GNU/*/Linux	Not Vulnerable	31-Jul-2003
Red Hat Inc.	Vulnerable	1-Aug-2003
SGI	Not Vulnerable	1-Aug-2003
Sun Microsystems Inc.	Vulnerable	4-Aug-2003
SuSE Inc.	Vulnerable	1-Aug-2003
TurboLinux	Vulnerable	4-Aug-2003
Wind River Systems Inc.	Vulnerable	15-Aug-2003
WU-FTPD Development Group	Vulnerable	15-Aug-2003

References

http://isec.pl/vulnerabilities/isec-0011-wu-ftpd.txt
http://www.wuftpd.org/
http://www.secunia.com/advisories/9406/

Credit

Thanks to Janusz Niewiadomski and Wojciech Purczynski for reporting this vulnerability.

This document was written by Jason A Rafail and Jeffrey S Havrilla.

Other Information

Date Public:	2003-07-31
Date First Published:	2003-07-31
Date Last Updated:	2003-08-15
CERT Advisory:
CVE-ID(s):	CAN-2003-0466
NVD-ID(s):	CAN-2003-0466
US-CERT Technical Alerts:
Metric:	6.75
Document Revision:	16

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Get Adobe Reader