wu-ftpd 2.6.2 and earlier, with the restricted-gid option enabled, allows local users to bypass access restrictions by changing the permissions to prevent access to their home directory, which causes wu-ftpd to use the root directory instead.

Glenn Stewart reports a bug in wu-ftpd's ftpaccess `restricted-uid'/`restricted-gid' directives :

Users can get around the restriction to their home directory by issuing a simple chmod command on their home directory. On the next ftp log in, the user will have '/' as their root directory.

Matt Zimmerman discovered that the cause of the bug was a missing check for a restricted user within a code path that is executed only when a certain error is encountered.

s700_800 11.23 ftpd(1M) and ftp(1) patch : 

A potential vulnerability has been identified with HP-UX running wu-ftpd with the restricted gid option enabled where the vulnerability could be exploited by a local user to gain unauthorized access to files.

s700_800 11.23 ftpd(1M) patch : 

The remote HP-UX host is affected by multiple vulnerabilities :

  - A potential vulnerability has been identified with HP-UX     running wu-ftpd with the restricted gid option enabled     where the vulnerability could be exploited by a local     user to gain unauthorized access to files. (HPSBUX01059     SSRT4704)

  - A potential vulnerability has been identified with HP-UX     running ftpd where the vulnerability could be exploited     to allow a remote authorized user unauthorized access to     files. (HPSBUX01119 SSRT4694)

s700_800 11.22 ftpd(1M) and ftp(1) patch : 

The remote HP-UX host is affected by multiple vulnerabilities :

  - A potential vulnerability has been identified with HP-UX     running ftpd where the vulnerability could be exploited     to allow a remote authorized user unauthorized access to     files. (HPSBUX01119 SSRT4694)

  - A potential security vulnerability has been identified     with HP-UX running ftp where the vulnerability could be     exploited remotely to allow unauthorized access.
    (HPSBUX01050 SSRT3456)

  - The wu-ftpd program is potentially vulnerable to a     buffer overflow. (HPSBUX00277 SSRT3606)

  - A potential security vulnerability has been identified     with HP-UX running ftpd, where a buffer overflow in ftpd     could be remotely exploited to allow an unauthorized     user to gain privileged access. (HPSBUX01118 SSRT4883)

  - A potential vulnerability has been identified with HP-UX     running wu-ftpd with the restricted gid option enabled     where the vulnerability could be exploited by a local     user to gain unauthorized access to files. (HPSBUX01059     SSRT4704)

Two vulnerabilities were discovered in wu-ftpd :

  - CAN-2004-0148     Glenn Stewart discovered that users could bypass the     directory access restrictions imposed by the     restricted-gid option by changing the permissions on     their home directory. On a subsequent login, when access     to the user's home directory was denied, wu-ftpd would     fall back to the root directory.

  - CAN-2004-0185

    A buffer overflow existed in wu-ftpd's code which deals     with S/key authentication.

The remote host is running wu-ftpd 2.6.2 or older.  There is a bug in this version which may allow an attacker to bypass the restricted-gid feature and gain unauthorized access to otherwise restricted directories. In addition, this version is prone to a remote overflow in the S/KEY authentication.

An updated wu-ftpd package that fixes two security issues is now available.

The wu-ftpd package contains the Washington University FTP (File Transfer Protocol) server daemon. FTP is a method of transferring files between machines.

Glenn Stewart discovered a flaw in wu-ftpd. When configured with 'restricted-gid home', an authorized user could use this flaw to circumvent the configured home directory restriction by using chmod.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0148 to this issue.

Michael Hendrickx found a flaw in the S/Key login handling. On servers using S/Key authentication, a remote attacker could overflow a buffer and potentially execute arbitrary code.

Users of wu-ftpd are advised to upgrade to this updated package, which contains backported security patches and is not vulnerable to these issues.

The remote host is running wu-ftpd 2.6.2 or older.

There is a bug in this version which may allow an attacker to bypass the 'restricted-gid' feature and gain unauthorized access to otherwise restricted directories.

*** Nessus solely relied on the banner of the remote FTP server, so this might
*** be a false positive.

ID	Name	Product	Family	Severity
37480	FreeBSD : wu-ftpd ftpaccess `restricted-uid'/`restricted-gid' directive may be bypassed (3b7c7f6c-7102-11d8-873f-0020ed76ef5a)	Nessus	FreeBSD Local Security Checks	high
26128	HP-UX PHNE_31732 : HP-UX Running wu-ftpd Local Unauthorized Access (HPSBUX01059 SSRT4704 rev.4)	Nessus	HP-UX Local Security Checks	high
17422	HP-UX PHNE_30983 : s700_800 11.23 ftpd(1M) patch	Nessus	HP-UX Local Security Checks	high
16907	HP-UX PHNE_29462 : s700_800 11.22 ftpd(1M) and ftp(1) patch	Nessus	HP-UX Local Security Checks	critical
15294	Debian DSA-457-1 : wu-ftpd - several vulnerabilities	Nessus	Debian Local Security Checks	critical
1208	WU-FTPD < 2.6.3 Multiple Vulnerabilities	Nessus Network Monitor	FTP Servers	high
12475	RHEL 2.1 : wu-ftpd (RHSA-2004:096)	Nessus	Red Hat Local Security Checks	critical
12098	WU-FTPD restricted-gid Directory Access Restriction Bypass	Nessus	FTP	high

Detections

Analytics

CVE-2004-0148

high

Tenable Plugins

high

high

high

critical

critical

high

critical

high