Title: Rumpus FTP Server Multiple Vulnerabilities
Severity: CRITICAL
Description:
Rumpus FTP server is an FTP server for Apple Mac OS X.
Rumpus is prone to multiple vulnerabilities, including multiple remote heap-overflow issues, denial-of-service issues, and local privilege-escalation issues. The remote issues affect the FTP and HTTP components of the server.
The heap-overflow and denial-of service issues were not specified by the reporter. Heap-overflow vulnerabilities arise because an application fails to do proper boundary checks. The server likely experiences boundary errors when processing user-supplied data. If an attacker supplies malicious data to the application, they may trigger heap overflows, resulting in memory corruption. This may ultimately result in arbitrary code execution.
The local privilege-escalation issue arises because the server fails to use absolute paths when issuing a call to the 'system()' function. This can allow local attackers to provide a malicious binary and have it run by 'system()' in place of the intended program. This can facilitate code execution, resulting in privilege escalation.
Reports indicate that the application is also affected by local privilege-escalation issues that relate to improper permissions associated with sensitive files and handling setuid binaries. Further details were not provided.
Since Rumpus runs with superuser privileges, a successful attack may facilitate the complete compromise of affected computers.
Rumpus 5.1 and prior versions are vulnerable to these issues.
Affected Products:
- Maxum Rumpus FTP Server 1.3.2
- Maxum Rumpus FTP Server 1.3.4
- Maxum Rumpus FTP Server 1.3.5
- Maxum Rumpus FTP Server 1.3.6
- Maxum Rumpus FTP Server 2.0.3dev
- Maxum Rumpus FTP Server 5.0
- Maxum Rumpus FTP Server 5.1
References:
- LMH <lmh [at] info-pull.com>: MOAB-18-01-2007: Rumpus Multiple Vulnerabilities
- Maxum: Rumpus FTP Server Product Page
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
