From: SecuriTeam <support@securiteam.com.>
To: [email protected]
Date: 25 Apr 2005 17:10:39 +0200
Subject: [UNIX] Canonicalization and Directory Traversal in iSeries FTP Security Products
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-Id: <20050425145106.A6FEF58C1@mail.tyumen.ru.>
X-Virus-Scanned: antivirus-gw at tyumen.ru
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Canonicalization and Directory Traversal in iSeries FTP Security Products
------------------------------------------------------------------------
SUMMARY
The IBM iSeries (AS/400) server provides a "unified access scheme, called
IFS, to all of the files and to all of the database tables in all of the
database libraries".
Because the built-in FTP server provides full access to the IFS, a valid,
authenticated user, can access and retrieve via FTP all of the database
tables and all of the files that he has authority to access, based on the
server assigned object authority.
DETAILS
The problem is usually addressed by third party iSeries security products
that attempt to limit FTP users only to the assets they should have access
to.
For example, these products supposedly can limit access to a folder called
/home/bp/outgoing, so while getting a file called
/home/bp/outgoing/dailysales.csv is allowed while getting a file called
/qsys.lib/aplibf.lib/apcaccp.file/apcaccp.mbr is blocked.
Several iSeries security products have been found to be vulnerable to a
canonicalization attack resulting in a possible unauthorized access to
iSeries database tables that were supposedly blocked from access.
For example, these products allows this FTP command:
GET
/home/bp/outgoing/../../../qsys.lib/aplibf.lib/apcaccp.file/apcaccp.mbr
The following iSeries security vendors were approached to see whether
their products are vulnerable to this canonicalization attack:
RazLee: notified on Feb 15, fix is available.
Castlehill: notified on March 15, fix is available.
Powertech: notified on March 15, fix is available.
Bsafe: notified on March 2, vendor has no comment.
SafeStone: notified on March 15, no reply received.
NetIQ: notified on March 15, no reply received.
iSeries servers without FTP security protection are vulnerable by default.
ADDITIONAL INFORMATION
The information has been provided by <mailto:shalom@venera.com.> Shalom
Carmel.
The original article can be found at:
<http://www.venera.com/downloads/Canonicalization_problems_in_iSeries_FTP_security.pdf>; http://www.venera.com/downloads/Canonicalization_problems_in_iSeries_FTP_security.pdf
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: [email protected]
In order to subscribe to the mailing list, simply forward this email to: [email protected]
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
