tnftpd allows attacker to gain root access
| tnftpd-gain-access (17020) |  High Risk |
Description:
tnftpd (formerly lukemftpd) could allow a remote attacker to gain unauthorized root access. A remote attacker could exploit a combination of multiple vulnerabilities to gain root access to the system.
Heimdal version 0.6.2. is also affected by this vulnerability.
Consequences:
Gain Access
Remedy:
For NetBSD-current and 2.0 branch (dated prior to 2004-08-15), 1.6.2, 1.6.1, 1.6, 1.5.3, 1.5.2, 1.5.1 and 1.5 :
Upgrade to the appropriate fixed versions of NetBSD, as listed in NetBSD Security Advisory 2004-009. See References.
For Gentoo Linux:
Upgrade to the latest version of heimdal (0.6.3 or later), as listed in GLSA 200409-19. See References.
For Debian GNU/Linux 3.0 (alias woody):
Upgrade to the latest lukemftpd package (1.1-1woody2 or later), as listed in DSA-551-1. See References.
For Sun JDS:
Apply the appropriate patch for your system, as listed below. Refer to Sun Alert ID: 57655 for more information. See References.
Sun Java Desktop System (JDS) 2003 with the updated RPMs (patch-9369) or later
Sun Java Desktop System (JDS) Release 2 with the updated RPMs (patch-9369) or later
For other distributions:
Contact your vendor for upgrade or patch information.
References:
- BugTraq Mailing List, Tue Aug 17 2004 - 12:01:27 CDT: Multiple remote vulnerabilities in lukemftpd aka. tnftpd.
- CIAC Information Bulletin P-016: Sun FTP Daemon of Heimdal is Vulnerable to Race Conditions.
- NetBSD Security Advisory 2004-009: Remote root for systems providing ftpd service.
- Sun Alert ID: 57655: The FTP Daemon of Heimdal is Vulnerable to Multiple Signal Handler Race Conditions.
- BID-10967: TNFTPD Multiple Signal Handler Remote Superuser Compromise Vulnerabilities
- CVE-2004-0794: Multiple signal handler race conditions in lukemftpd (aka tnftpd before 20040810) allow remote authenticated attackers to cause a denial of service or execute arbitrary code.
- DSA-551: lukemftpd -- incorrect internal variable handling
- GLSA-200409-19: Heimdal: ftpd root escalation
Platforms Affected:
- Debian Debian Linux 3.0
- Gentoo Linux
- Heimdal Developers Heimdal 0.6.2
- NetBSD NetBSD 1.5
- NetBSD NetBSD 1.5.1
- NetBSD NetBSD 1.5.2
- NetBSD NetBSD 1.5.3
- NetBSD NetBSD 1.6
- NetBSD NetBSD 1.6.1
- NetBSD NetBSD 1.6.2
- NetBSD NetBSD 2.0
- NetBSD NetBSD CURRENT
- Sun JDS 2003
- Sun JDS Release 2
Reported:
Aug 17, 2004
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net