FTP: WU-FTPD Setproctitle() Format String

This signature detects an attempt to exploit a ftp daemon by submitting a malicious SITE request containing format string characters. Successful exploitation can allow an attacker to execute arbitrary code with user privileges running the ftp daemon.

Extended Description

A number of ftp daemons, including versions of wu-ftpd, OpenBSD ftpd (ports of this package are distributed with some Linux distributions), HP-UX ftpd, and proftpd, have a vulnerability caused by the passing of user input to the set_proc_title() function. This function in turn calls setproctitle() after using this user data to generate a buffer to pass to setproctitle. setproctitle is defined as setproctitle(char *fmt, ...). The buffer created is passed as the format argument to setproctitle. setproctitle will make a call to the vsnprintf() call, taking the buffer passed as the format string. By carefully manipulating the contents of this buffer, a remote user can cause values on the stack to be overwritten, and potentially cause arbitrary code to be executed as root.

Affected Products

Suse linux

References

BugTraq: 1425

CVE: CVE-2000-0574

URL: http://www.securiteam.com/exploits/5NP0J1520C.html http://archives.neohapsis.com/archives/bugtraq/2000-07/0061.html

Short Name

FTP:WU-FTP:SETPROCTITLE

Severity

Critical

Recommended

False

Recommended Action

Drop

FTP: WU-FTPD Setproctitle() Format String

Extended Description

Affected Products

References

Found a potential security threat?