TITLE:
Linux-ftpd-ssl FTP Server Response Buffer Overflow Vulnerability

SECUNIA ADVISORY ID:
SA17465

VERIFY ADVISORY:
http://secunia.com/advisories/17465/

CRITICAL:
Moderately critical

IMPACT:
System access

WHERE:
>From remote

SOFTWARE:
Linux-ftpd-ssl 0.x
http://secunia.com/product/6058/

DESCRIPTION:
kcope has reported a vulnerability in Linux-ftpd-ssl, which can be
exploited by malicious users to compromise a vulnerable system.

The vulnerability is caused due to the unsafe use of the "vsprintf()"
function in the FTP server to generate replies in response to commands
received from the FTP client. This causes a stack-based buffer
overflow when the output of a command exceeds 2048 bytes. The
vulnerability can be exploited by creating multiple levels of
sub-directories with long names, and then issuing the "XPWD" command
when at the lowest level sub-directory. The resulting path name that
is generated in response the "XPWD" will exceed 2048 bytes,
overflowing the stack-buffer.

Successful exploitation requires that the user is able to create
directories on the FTP server, or perform some actions that will
cause the FTP server to generate an overly long reply.

The vulnerability affects NetKit Linux-ftpd version 0.17 with the
Linux-ftpd-ssl patch version 0.3. Other versions may also be
vulnerable.

NOTE: The vulnerability was introduced due to the Linux-ftpd-ssl
patch. An exploit for this vulnerability is publicly available.

SOLUTION:
Grant only trusted users access to the FTP server.

PROVIDED AND/OR DISCOVERED BY:
kcope

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------