Buffer overflow in the skey_challenge function in ftpd.c for wu-ftp daemon (wu-ftpd) 2.6.2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a s/key (SKEY) request with a long name.

Two vulnerabilities were discovered in wu-ftpd :

  - CAN-2004-0148     Glenn Stewart discovered that users could bypass the     directory access restrictions imposed by the     restricted-gid option by changing the permissions on     their home directory. On a subsequent login, when access     to the user's home directory was denied, wu-ftpd would     fall back to the root directory.

  - CAN-2004-0185

    A buffer overflow existed in wu-ftpd's code which deals     with S/key authentication.

This version of WU-FTPD contains a remote overflow if s/key support is enabled. The skey_challenge function fails to perform bounds checking on the name variable resulting in a buffer overflow. With a specially crafted request, an attacker can execute arbitrary code resulting in a loss of integrity and/or availability.

It appears that this vulnerability may be exploited prior to authentication.
It is reported that S/Key support is not enabled by default, though some operating system distributions which ship WU-FTPD may have it enabled.

*** Nessus solely relied on the banner of the remote server
*** to issue this warning, so it may be a false positive.

The remote host is running wu-ftpd 2.6.2 or older.  There is a bug in this version which may allow an attacker to bypass the restricted-gid feature and gain unauthorized access to otherwise restricted directories. In addition, this version is prone to a remote overflow in the S/KEY authentication.

An updated wu-ftpd package that fixes two security issues is now available.

The wu-ftpd package contains the Washington University FTP (File Transfer Protocol) server daemon. FTP is a method of transferring files between machines.

Glenn Stewart discovered a flaw in wu-ftpd. When configured with 'restricted-gid home', an authorized user could use this flaw to circumvent the configured home directory restriction by using chmod.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0148 to this issue.

Michael Hendrickx found a flaw in the S/Key login handling. On servers using S/Key authentication, a remote attacker could overflow a buffer and potentially execute arbitrary code.

Users of wu-ftpd are advised to upgrade to this updated package, which contains backported security patches and is not vulnerable to these issues.

ID	Name	Product	Family	Severity
15294	Debian DSA-457-1 : wu-ftpd - several vulnerabilities	Nessus	Debian Local Security Checks	critical
14372	WU-FTPD S/KEY Authentication ftpd.c skey_challenge Function Remote Overflow	Nessus	FTP	critical
1208	WU-FTPD < 2.6.3 Multiple Vulnerabilities	Nessus Network Monitor	FTP Servers	high
12475	RHEL 2.1 : wu-ftpd (RHSA-2004:096)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2004-0185

critical

Tenable Plugins

critical

critical

high

critical