FTP: WU-FTPD Off-by-One Buffer Overflow

This signature detects attempts to exploit a known vulnerability in WU-FTPD. A successful attack can lead to a buffer overflow and arbitrary remote code execution within the context of the targeted application.

Extended Description

The 'realpath()' function is a C-library procedure to resolve the canonical, absolute pathname of a file based on a path that may contain values such as '/', './', '../', or symbolic links. A vulnerability that was reported to affect the implementation of 'realpath()' in WU-FTPD has lead to the discovery that at least one implementation of the C library is also vulnerable. FreeBSD has announced that the off-by-one stack- buffer-overflow vulnerability is present in their libc. Other systems are also likely vulnerable. Reportedly, this vulnerability has been successfully exploited against WU-FTPD to execute arbitrary instructions. NOTE: Patching the C library alone may not remove all instances of this vulnerability. Statically linked programs may need to be rebuilt with a patched version of the C library. Also, some applications may implement their own version of 'realpath()'. These applications would require their own patches. FreeBSD has published a large list of applications that use 'realpath()'. Administrators of FreeBSD and other systems are urged to review it. For more information, see the advisory 'FreeBSD-SA-03:08.realpath'.

Affected Products

Netbsd netbsd

References

BugTraq: 8315

CVE: CVE-2003-0466

URL: http://www3.ca.com/securityadvisor/vulninfo/Vuln.aspx?ID=25602 http://www.securityfocus.com/archive/1/12937/1999-03-20/1999-03-26/0

Short Name

FTP:WU-FTP:OFFBYONE-BOF

Severity

Major

Recommended

False

Recommended Action

None

FTP: WU-FTPD Off-by-One Buffer Overflow

Extended Description

Affected Products

References

Found a potential security threat?