Vulnerabilities > CVE-2006-5778 - Information Disclosure vulnerability in Linux-Ftpd-Ssl 0.17

047910
CVSS 4.6 - MEDIUM
Attack vector
LOCAL
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
local
low complexity
linux-ftpd-ssl
nessus
NVD
Published: 2006-11-07
Updated: 2008-09-05

Summary

ftpd in linux-ftpd 0.17, and possibly other versions, performs a chdir before setting the UID, which allows local users to bypass intended access restrictions by redirecting their home directory to a restricted directory.

Vulnerable Configurations

Part Description Count
Application
Linux-Ftpd-Ssl
1

Nessus

  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-1217.NASL
    descriptionPaul Szabo discovered that the netkit ftp server switches the user id too late, which may lead to the bypass of access restrictions when running on NFS. This update also adds return value checks to setuid() calls, which may fail in some PAM configurations.
    last seen2020-06-01
    modified2020-06-02
    plugin id23703
    published2006-11-22
    reporterThis script is Copyright (C) 2006-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/23703
    titleDebian DSA-1217-1 : linux-ftpd - programming error
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-200611-05.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-200611-05 (Netkit FTP Server: Privilege escalation) Paul Szabo reported that an incorrect seteuid() call after the chdir() function can allow an attacker to access a normally forbidden directory, in some very particular circumstances, for example when the NFS-hosted targetted directory is not reachable by the client-side root user. Additionally, some potentially exploitable unchecked setuid() calls were also fixed. Impact : A local attacker might craft his home directory to gain access through ftpd to normally forbidden directories like /root, possibly with writing permissions if seteuid() fails and if the ftpd configuration allows that. The unchecked setuid() calls could also lead to a root FTP login, depending on the FTP server configuration. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id23670
    published2006-11-20
    reporterThis script is Copyright (C) 2006-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/23670
    titleGLSA-200611-05 : Netkit FTP Server: Privilege escalation

References