MIT Kerberos gssftp daemon denial of service
| kerberos-gssftpd-dos (4734) |  Medium Risk |
Description:
MIT Kerberos 5 is vulnerable to a denial of service attack. The gssftp daemon could allow a remote user to execute certain FTP commands without authorization and crash the system. An attacker with a local account may be able to use this vulnerability to gain root access.
Platforms Affected:
- MIT, Kerberos 5-1.1
- MIT, Kerberos 5-1.1.1
Remedy:
Upgrade to MIT Kerberos 5 version 1.2 when it becomes available.
As a workaround, apply the ftpd_111 patch from MIT, as listed in the Kerberos Security Advisory. See References.
Consequences:
Denial of Service
References:
- BugTraq Mailing List, Wed Jun 14 2000 - 17:36:03 CDT, Security Advisory: REMOTE ROOT VULNERABILITY IN GSSFTP DAEMON at http://archives.neohapsis.com/archives/bugtraq/2000-06/0129.html.
- Kerberos Security Advisory, Remote root vulnerability in GSSFTPD at http://web.mit.edu/kerberos/www/advisories/ftp.txt.
- BID-1374: GSSFTP Daemon Input Validation Vulnerability
- CVE-2000-0514: GSSFTP FTP daemon in Kerberos 5 1.1.x does not properly restrict access to some FTP commands, which allows remote attackers to cause a denial of service, and local users to gain root privileges.
- OSVDB ID: 4885: Kerberos 5 GSSFTP FTP Command Restriction Issue
Reported:
Jun 14, 2000
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
Copyright (c) 1994-2008 Internet Security Systems, Inc. All rights reserved worldwide.
For corrections or additions please email xforce@iss.net