リモート WU-FTPD サーバーは、巨大なディレクトリ構造を扱う際に、Off-by-one オーバーフローに対して脆弱なようです。 

攻撃者は、この欠陥を悪用して、このホストのシェルを取得することがあります。 

とりわけパッチが既に適用されている場合、Nessus は、リモートサーバーのバナーにのみ依存してこの警告を出すため、誤検知の可能性があることに注意してください。

Janusz Niewiadomski 氏および Wojciech Purczynskiwu 氏によって、ftpd FTP サーバーパッケージにおける脆弱性が発見されました。彼らは、fb_realpath() 関数における off-by-one バグを見つけました。このバグは、リモートの攻撃者がサーバー上で root 権限を取得するために使用される可能性があります。このバグは、Linux 2.0.x および 2.4.x カーネル以降でコンパイルされた wu-ftpd バイナリを使用してのみ機能させることができます。これは、2.2.x および 2.4.x 以前のカーネルが、PATH_MAX を 4095 文字として定義するためです。

wuftpd は、Mandrake Linux には付属されなくなっています。ただし、Mandrake Linux 8.2 には、wu-ftpd が含まれていました。wu-ftpd を使用している場合は、これらのパッチ適用済みのバージョンにアップグレードすることが推奨されます。

The remote WU-FTPD server seems to be vulnerable to an off-by-one overflow when dealing with huge directory structures. 

An attacker may exploit this flaw to obtain a shell on this host. 

Note that Nessus has solely relied on the banner of the remote server to issue this warning so it may be a false-positive, especially if the patch has already been applied.

Janusz Niewiadomski 和 Wojciech Purczynski 在 wu-ftpd FTP 服务器程序包中发现一个漏洞。他们在 fb_realpath() 函数中发现一个差一缺陷，此缺陷可被远程攻击者用户用来获取服务器上的根权限。仅可通过使用在 Linux 2.0.x 和更高的 2.4.x 内核上编译的 wu-ftpd 二进制文件来成功实现此缺陷，原因是 2.2.x 和更早的 2.4.x 内核将 PATH_MAX 定义为 4095 个字符。

wu-ftpd 不再随附于 Mandrake Linux，但 Mandrake Linux 8.2 确实包含 wu-ftpd。如果使用 wu-ftpd，建议您升级这些修补后的程序包。

远程 WU-FTPD 服务器在处理巨大目录结构时似乎容易受到差一漏洞的影响。 

攻击者可能会利用此缺陷获取此主机上的 shell 。 

请注意，Nessus 仅依赖远程服务器的标题来发布此警告，因此这可能是误报，尤其是在已安装修补程序的情况下。

Updated wu-ftpd packages are available that fix an off-by-one buffer overflow.

The wu-ftpd package contains the Washington University FTP (File Transfer Protocol) server daemon. FTP is a method of transferring files between machines.

An off-by-one bug has been discovered in versions of wu-ftpd up to and including 2.6.2. On a vulnerable system, a remote attacker would be able to exploit this bug to gain root privileges.

Red Hat Enterprise Linux contains a version of wu-ftpd that is affected by this bug, although it is believed that this issue will not be remotely exploitable due to compiler padding of the buffer that is the target of the overflow. However, Red Hat still advises that all users of wu-ftpd upgrade to these erratum packages, which contain a security patch.

Red Hat would like to thank Wojciech Purczynski and Janusz Niewiadomski of ISEC Security Research for their responsible disclosure of this issue.

Janusz Niewiadomski 和 Wojciech Purczynski 在 wu-ftpd FTP 伺服器套件中發現一個弱點。他們在 fb_realpath() 函式中發現一個差一錯誤，遠端攻擊者可利用此錯誤，取得伺服器的 root 權限。只有使用在 Linux 2.0.x 版和之後的 2.4.x 版核心上編譯的 wu-ftpd 二進位，才能成功完成此錯誤，因為 2.2.x 版和之前的 2.4.x 版核心將 PATH_MAX 定義為 4095 個字元。

wu-ftpd 不再隨附於 Mandrake Linux，但是 Mandrake Linux 8.2 會隨附於 wu-ftpd。如果您使用 wu-ftpd，建議您升級至這些修補過的套件。

s700_800 11.11 ftpd(1M) and ftp(1) patch : 

The remote HP-UX host is affected by multiple vulnerabilities :

  - The wu-ftpd program is potentially vulnerable to a     buffer overflow. (HPSBUX00277 SSRT3606)

  - A potential security vulnerability has been identified     with HP-UX running ftpd, where a buffer overflow in ftpd     could be remotely exploited to allow an unauthorized     user to gain privileged access. (HPSBUX01118 SSRT4883)

  - A potential security vulnerability has been identified     with HP-UX running ftp where the vulnerability could be     exploited remotely to allow unauthorized access.
    (HPSBUX01050 SSRT3456)

A vulnerability was discovered by Janusz Niewiadomski and Wojciech Purczynski in the wu-ftpd FTP server package. They found an off-by- one bug in the fb_realpath() function which could be used by a remote attacker to obtain root privileges on the server. This bug can only be successfully accomplished by using wu-ftpd binaries compiled on Linux 2.0.x and later 2.4.x kernels because the 2.2.x and earlier 2.4.x kernels define PATH_MAX to be 4095 characters.

wu-ftpd is no longer shipped with Mandrake Linux, however Mandrake Linux 8.2 did come with wu-ftpd. If you use wu-ftpd, you are encouraged to upgrade to these patched packages.

s700_800 11.22 ftpd(1M) and ftp(1) patch : 

The remote HP-UX host is affected by multiple vulnerabilities :

  - A potential vulnerability has been identified with HP-UX     running ftpd where the vulnerability could be exploited     to allow a remote authorized user unauthorized access to     files. (HPSBUX01119 SSRT4694)

  - A potential security vulnerability has been identified     with HP-UX running ftp where the vulnerability could be     exploited remotely to allow unauthorized access.
    (HPSBUX01050 SSRT3456)

  - The wu-ftpd program is potentially vulnerable to a     buffer overflow. (HPSBUX00277 SSRT3606)

  - A potential security vulnerability has been identified     with HP-UX running ftpd, where a buffer overflow in ftpd     could be remotely exploited to allow an unauthorized     user to gain privileged access. (HPSBUX01118 SSRT4883)

  - A potential vulnerability has been identified with HP-UX     running wu-ftpd with the restricted gid option enabled     where the vulnerability could be exploited by a local     user to gain unauthorized access to files. (HPSBUX01059     SSRT4704)

iSEC Security Research reports that wu-ftpd contains an off-by-one bug in the fb_realpath function which could be exploited by a logged-in user (local or anonymous) to gain root privileges. A demonstration exploit is reportedly available.

s700_800 11.00 ftpd(1M) and ftp(1) patch : 

The remote HP-UX host is affected by multiple vulnerabilities :

  - A potential security vulnerability has been identified     with HP-UX running ftp where the vulnerability could be     exploited remotely to allow unauthorized access.
    (HPSBUX01050 SSRT3456)

  - A potential security vulnerability has been identified     with HP-UX running ftpd, where a buffer overflow in ftpd     could be remotely exploited to allow an unauthorized     user to gain privileged access. (HPSBUX01118 SSRT4883)

  - The wu-ftpd program is potentially vulnerable to a     buffer overflow. (HPSBUX00277 SSRT3606)

The remote host is missing the patch for the advisory SUSE-SA:2003:032 (wuftpd).


Janusz Niewiadomski and Wojciech Purczynski of iSEC Security Research have found a single byte buffer overflow in the Washington University ftp daemon (wuftpd), a widely used ftp server for Linux-like systems.
It is yet unclear if this bug is (remotely) exploitable. Positive exploitability may result in a remote root compromise of a system running the wuftpd ftp daemon.

Notes:
* SUSE LINUX products do not contain wuftpd any more starting with SUSE Linux 8.0 and SUSE LINUX Enterprise Server 8. The wuftpd package has been substituted by a different server implementation of the file transfer protocol server.
* The affected wuftpd packages in products as stated in the header of this announcement actually ship two different wuftpd ftp daemon versions: The older version 2.4.x that is installed as /usr/sbin/wu.ftpd, the newer version 2.6 is installed as /usr/sbin/wu.ftpd-2.6 . The 2.4.x version does not contain the defective parts of the code and is therefore not vulnerable to the weakness found.
* If you are using the wuftpd ftp daemon in version 2.4.x, you might want to update the package anyway in order not to risk an insecure configuration once you switch to the newer version.

There exists no workaround that can fix this vulnerability on a temporary basis other than just using the 2.4.x version as mentioned above.
The proper fix for the weakness is to update the package using the provided update packages.

Please download the update package for your distribution and verify its integrity by the methods listed in section 3) of this announcement.
Then, install the package using the command 'rpm -Fhv file.rpm' to apply the update.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
11811	WU-FTPD fb_realpath() 機能の Off-by-one オーバーフロー	Nessus	FTP	2003/7/31	2018/11/15	critical
61921	Mandrake Linux セキュリティアドバイザリ：wu-ftpd（MDKSA-2003:080）	Nessus	Mandriva Local Security Checks	2012/9/6	2021/1/6	critical
11811	WU-FTPD fb_realpath() Function Off-by-one Overflow	Nessus	FTP	2003/7/31	2018/11/15	critical
61921	Mandrake Linux 安全公告：wu-ftpd (MDKSA-2003:080)	Nessus	Mandriva Local Security Checks	2012/9/6	2021/1/6	critical
11811	WU-FTPD fb_realpath() 函数差一溢出	Nessus	FTP	2003/7/31	2018/11/15	critical
12413	RHEL 2.1 : wu-ftpd (RHSA-2003:246)	Nessus	Red Hat Local Security Checks	2004/7/6	2021/1/14	critical
61921	Mandrake Linux 安全性公告：wu-ftpd (MDKSA-2003:080)	Nessus	Mandriva Local Security Checks	2012/9/6	2021/1/6	critical
16908	HP-UX PHNE_29461 : s700_800 11.11 ftpd(1M) and ftp(1) patch	Nessus	HP-UX Local Security Checks	2005/2/16	2021/1/11	critical
61921	Mandrake Linux Security Advisory : wu-ftpd (MDKSA-2003:080)	Nessus	Mandriva Local Security Checks	2012/9/6	2021/1/6	critical
16907	HP-UX PHNE_29462 : s700_800 11.22 ftpd(1M) and ftp(1) patch	Nessus	HP-UX Local Security Checks	2005/2/16	2021/1/11	critical
15194	Debian DSA-357-1 : wu-ftpd - remote root exploit	Nessus	Debian Local Security Checks	2004/9/29	2021/1/4	critical
16909	HP-UX PHNE_29460 : s700_800 11.00 ftpd(1M) and ftp(1) patch	Nessus	HP-UX Local Security Checks	2005/2/16	2021/1/11	critical
13801	SUSE-SA:2003:032: wuftpd	Nessus	SuSE Local Security Checks	2004/7/25	2021/1/14	critical

検出

プラグインの検索

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical