Kerberos 5 FTPd Buffer Overflow (ftpglob function)

A remotely exploitable security vulnerability has been discovered in Kerberos version 5's FTP daemon. The vulnerability is exploitable both via anonymous FTP and via local account access. The vulnerability results from a buffer overflow in code that calls ftpglob(), a function responsible for expanding glob characters in pathnames. Recent versions of FTPd (krb5-1.2 or later) should not contain buffer overflows in the ftpglob() function itself.

Remote users able to authenticate to the FTP daemon may be able to exploit a lack of bounds-checking in calling radix_encode(). Login access is not required; the ability to force arbitrary data to be base64-encoded by radix_encode() is sufficient.

This vulnerability is believed to be somewhat difficult to exploit (but by no means impossible) due to the need for an attacker to inject data that will base64-encode to the desired machine code and target address.

Details

Vulnerable systems:

MIT Kerberos 5, all releases.

Impact:

* If anonymous FTP is enabled, a remote user may gain unauthorized root access.

* A user with access to a local account may gain unauthorized root access.

* A remote user who can successfully authenticate to the FTP daemon may obtain unauthorized root access, regardless of whether anonymous FTP is enabled or whether access is granted to a local account. This vulnerability is believed to be somewhat difficult to exploit.

Workaround:

The recommended approach is to apply the patches and to rebuild your FTPd.

If you cannot patch your FTPd currently, workarounds include disabling anonymous FTP access, if you have it enabled; this will limit the most likely exploitation to users with local account access or who can successfully authenticate to the daemon.

This announcement and code patches related to it may be found on the MIT Kerberos security advisory page at:

http://web.mit.edu/kerberos/www/advisories/index.html

The main MIT Kerberos web page is at: http://web.mit.edu/kerberos/www/index.html

Patches against krb5-1.2.2:

These patches are against the krb5-1.2.2 release. They may also apply against earlier releases, though. The patches can be found here.