Symantec™ Security Gateways Reference Guide - Sawmill

312 IDS eventsIntrusion attemptsFTP Replydirname Buffer OverflowBase Event:Details:FTP_REPLYDIRNAME_BOThe FTP daemon derived from the 4.x BSD source contains a serious vulnerability that maycompromise root access.A 1-byte overflow in the replydirname() function exists. The overflow condition is due to an off-byonebug that lets an attacker write a null byte beyond the boundaries of a local buffer and over thelowest byte of the saved base pointer. As a result, the numerical value of the pointer decreases andpoints to a higher location, or lower address, on the stack than it should. When the replydirname()function returns, the modified and saved base pointer is stored in the base pointer register.When the calling function returns, the return address is read from an offset to where the basepointer points. The return address will be at the incorrect location, if the base pointer is set to zero.With the last byte of the base pointer zero, this is a location other than where it should be.If the attacker has control of this stack region, such as the local variable that contained the extrabyte in the first place, he or she can place an arbitrary address there. The function uses thisaddress as the saved return address.This is the case for ftpd. An attacker is able to force the FTP daemon to look in the user-supplieddata for a return address, and then execute instructions at the location as root.This vulnerability is exploited on systems supporting an anonymous FTP, if a writeable directoryexists (such as an “incoming” directory). This is rarely in place by default.Note: OpenBSD ships with FTP disabled, though it is a commonly used service.Response: OpenBSD has released a patch for this vulnerability. NetBSD has released patches for versions 1.4.3and 1.5.We recommend that users with NetBSD 1.4.2 or earlier upgrade, and then apply one of the patches.Disabling anonymous FTP may prevent remote users from exploiting this vulnerability.Stack protection schemes, such as StackGuard or non-executable stack configurations, may limitexploitability.Affected: BSD ftpd 0.3.2David A. Holland linux-ftpd 0.17David Madore ftpd-BSD 0.2.3NetBSD NetBSD 1.4NetBSD NetBSD 1.4.1NetBSD NetBSD 1.4.2NetBSD NetBSD 1.5OpenBSD OpenBSD 2.4OpenBSD OpenBSD 2.5OpenBSD OpenBSD 2.6OpenBSD OpenBSD 2.7OpenBSD OpenBSD 2.8False Positives: None known.References: Security Focus BID: 2124CVE-2001-0053NetBSD Security PageOpenBSD Security Information