Re: vsFTPd remote code execution

[Chris Evans <scarybeasts () gmail com>]

On Tue, Dec 13, 2011 at 12:11 PM, HI-TECH .
<isowarez.isowarez.isowarez () googlemail com> wrote:
> Yes you are somewhat right, as this is the old discussion about if
> code execution inside an ftpd
> is a vulnerability itself or only local code execution. I have the
> opinion that an ftpd which does not allow to run code
> should restrict the user so, and if there is a way to execute code it
> it is a vulnerability.
> Take the example of a vsftpd configured for anonymous ftp and write
> access in /var/ftp.

IIRC, vsftpd can refuse to start an anonymous session for the
misconfiguration where the root directory is writeable (to avoid
problems in the libc like this). I'll make sure it still works and
maybe check other paths such as /etc

For local users, there's a configuration setting: "chroot_local_user".
The compiled-in default is false, and the man page cautions:
---
.BR Warning:
This option has security implications, especially if the users have upload
permission, or shell access. Only enable if you know what you are doing.
---

I'm not uptodate with whether Linux distributions have turned this on
by default or not.

vsftpd does have the concept of "virtual users". I'm not sure if it's
widely used but it seems that this type of user login would present
the biggest headache.


Amusingly, vsftpd already attempts to desist glibc from loading any
timezone files from inside the chroot() (see env_init) by warming up
the subsystem and even explicitly setting TZ in the environment. glibc
displeases me. Perhaps it's a gmtime() vs. localtime() issue -- I'm
curious to know if glibc still crashes if the setting
"use_localtime=YES" is used?


I don't mind adding workarounds or avoidances for libc bugs (for
example, functions like regcomp, fnmatch have long been avoided). If
you had any clever ideas, I'm happy to put them in, otherwise it's a
case of waiting for the glibc updates.


Cheers
Chris

> The attacker might
> execute code using the vulnerability without authentication
> credentials, or for example an attacker only has
> access to a user account configured for ftp.
> Basically you are right, vsftpd uses privsep so its a not so risky
> vulnerability.
>
> /Kingcope
>
> Am 13. Dezember 2011 20:56 schrieb Dan Rosenberg <dan.j.rosenberg () gmail com>:
> > > Anyone with an up2date linux local root which only makes use of syscalls? :>
> >
> > This is all fun stuff, and definitely worth looking into further, but
> > if you've got a local kernel exploit that you can trigger from inside
> > vsftpd, you don't need this (potential) vulnerability in vsftpd - you
> > already win.
> >
> > -Dan
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/