151 lines
5.9 KiB
Text
151 lines
5.9 KiB
Text
-----BEGIN PGP SIGNED MESSAGE-----
|
|
Hash: SHA512
|
|
|
|
=============================================================================
|
|
FreeBSD-SA-14:26.ftp Security Advisory
|
|
The FreeBSD Project
|
|
|
|
Topic: Remote command execution in ftp(1)
|
|
|
|
Category: core
|
|
Module: ftp
|
|
Announced: 2014-11-04
|
|
Credits: Jared McNeill, Alistair Crooks
|
|
Affects: All supported versions of FreeBSD.
|
|
Corrected: 2014-11-04 23:29:57 UTC (stable/10, 10.1-PRERELEASE)
|
|
2014-11-04 23:34:46 UTC (releng/10.1, 10.1-RC4-p1)
|
|
2014-11-04 23:34:46 UTC (releng/10.1, 10.1-RC3-p1)
|
|
2014-11-04 23:34:46 UTC (releng/10.1, 10.1-RC2-p3)
|
|
2014-11-04 23:31:17 UTC (releng/10.0, 10.0-RELEASE-p12)
|
|
2014-11-04 23:30:47 UTC (stable/9, 9.3-STABLE)
|
|
2014-11-04 23:33:46 UTC (releng/9.3, 9.3-RELEASE-p5)
|
|
2014-11-04 23:33:17 UTC (releng/9.2, 9.2-RELEASE-p15)
|
|
2014-11-04 23:32:45 UTC (releng/9.1, 9.1-RELEASE-p22)
|
|
2014-11-04 23:30:23 UTC (stable/8, 8.4-STABLE)
|
|
2014-11-04 23:32:15 UTC (releng/8.4, 8.4-RELEASE-p19)
|
|
CVE Name: CVE-2014-8517
|
|
|
|
For general information regarding FreeBSD Security Advisories,
|
|
including descriptions of the fields above, security branches, and the
|
|
following sections, please visit <URL:http://security.FreeBSD.org/>.
|
|
|
|
I. Background
|
|
|
|
The ftp(1) userland utility is an interactive FTP client. It can also
|
|
be used non-interactively, by providing a URL on the command line. In
|
|
this mode, it supports HTTP in addition to FTP.
|
|
|
|
II. Problem Description
|
|
|
|
A malicious HTTP server could cause ftp(1) to execute arbitrary
|
|
commands.
|
|
|
|
III. Impact
|
|
|
|
When operating on HTTP URIs, the ftp(1) client follows HTTP redirects,
|
|
and uses the part of the path after the last '/' from the last
|
|
resource it accesses as the output filename if '-o' is not specified.
|
|
|
|
If the output file name provided by the server begins with a pipe
|
|
('|'), the output is passed to popen(3), which might be used to
|
|
execute arbitrary commands on the ftp(1) client machine.
|
|
|
|
IV. Workaround
|
|
|
|
No workaround is available. Users are encouraged to replace ftp(1) in
|
|
non-interactive use by either fetch(1) or a third-party client such as
|
|
curl or wget.
|
|
|
|
V. Solution
|
|
|
|
Perform one of the following:
|
|
|
|
1) Upgrade your vulnerable system to a supported FreeBSD stable or
|
|
release / security branch (releng) dated after the correction date.
|
|
|
|
2) To update your vulnerable system via a binary patch:
|
|
|
|
Systems running a RELEASE version of FreeBSD on the i386 or amd64
|
|
platforms can be updated via the freebsd-update(8) utility:
|
|
|
|
# freebsd-update fetch
|
|
# freebsd-update install
|
|
|
|
3) To update your vulnerable system via a source code patch:
|
|
|
|
The following patches have been verified to apply to the applicable
|
|
FreeBSD release branches.
|
|
|
|
a) Download the relevant patch from the location below, and verify the
|
|
detached PGP signature using your PGP utility.
|
|
|
|
[FreeBSD 8]
|
|
# fetch http://security.FreeBSD.org/patches/SA-14:26/ftp-8.patch
|
|
# fetch http://security.FreeBSD.org/patches/SA-14:26/ftp-8.patch.asc
|
|
# gpg --verify ftp-8.patch.asc
|
|
|
|
[All other versions]
|
|
# fetch http://security.FreeBSD.org/patches/SA-14:26/ftp.patch
|
|
# fetch http://security.FreeBSD.org/patches/SA-14:26/ftp.patch.asc
|
|
# gpg --verify ftp.patch.asc
|
|
|
|
b) Apply the patch. Execute the following commands as root:
|
|
|
|
# cd /usr/src
|
|
# patch < /path/to/patch
|
|
|
|
c) Recompile ftp. Execute the following commands as root:
|
|
|
|
# cd /usr/src/usr.bin/ftp
|
|
# make && make install
|
|
|
|
VI. Correction details
|
|
|
|
The following list contains the correction revision numbers for each
|
|
affected branch.
|
|
|
|
Branch/path Revision
|
|
- -------------------------------------------------------------------------
|
|
stable/8/ r274108
|
|
releng/8.4/ r274111
|
|
stable/9/ r274109
|
|
releng/9.1/ r274112
|
|
releng/9.2/ r274113
|
|
releng/9.3/ r274114
|
|
stable/10/ r274107
|
|
releng/10.0/ r274110
|
|
releng/10.1/ r274115
|
|
- -------------------------------------------------------------------------
|
|
|
|
To see which files were modified by a particular revision, run the
|
|
following command, replacing NNNNNN with the revision number, on a
|
|
machine with Subversion installed:
|
|
|
|
# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
|
|
|
|
Or visit the following URL, replacing NNNNNN with the revision number:
|
|
|
|
<URL:http://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
|
|
|
|
VII. References
|
|
|
|
<URL:http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8517>
|
|
|
|
The latest revision of this advisory is available at
|
|
<URL:http://security.FreeBSD.org/advisories/FreeBSD-SA-14:26.ftpd.asc>
|
|
-----BEGIN PGP SIGNATURE-----
|
|
|
|
iQIcBAEBCgAGBQJUWWUQAAoJEO1n7NZdz2rnhUwP+wQKrgKs6lRk6Yl4UtRyEwyG
|
|
BHGkA62oaQbehuccahjQgIcLTk3Vp3AalXtSQpdyWJktHiYrFwBnheW/IrhJ6bMS
|
|
dpJv3yqqQtSED9sADf+GAvxV6TG9bknq/RDxXKpsQ/MocYbiVxz/3nDOMz9CB7ep
|
|
saDttvGHW7RUmNoKL70pgItGapiVuBzMF01PCZ2SmFiJHYi7BoiJwm72Y1NLU8YE
|
|
TkiX2ZAoTVMN5/R3DW38HyVCyeY2tMTHSdQXRSYjwzJ0gEbBPWMPQyB1SAa8dtk5
|
|
j54KFNOBoaXMjd3USqFgo0fduU3rGZp5PwITTx5Rx5Ixtz2vHddyOISV0RcjA0cq
|
|
TWDwBGlKET7qZ1j7nHTgy4U4wMTWFbkjjqEY+RHYywaAmy8ACDmEUci8d3fWKWVY
|
|
d4y8RCvBrlnFVjmNiNcBc5XFXxY0Ra3BQ8C/VE0k0ZFuzmFUCi+DJZDR2Gtl0R9Q
|
|
1hAdj+yOJo46ylHPiSyoBZmsRZccV1a81phOPe0mPR84BvzNvBsdI+EFIJWi+5bw
|
|
bjuSM8YCOHrlGkqh9h9+BizvLfJFpjUSglwzPmOfRpTv59XJpc6D1Hia+uICTEfd
|
|
lSiJgDZ6enozY7QVoiO7G/ycyQCVe7Ehwywx/dpWXVpva85tn4Xl2khBCiPNbBBo
|
|
xnPjqxmwGK+4uegsO6CY
|
|
=QT3h
|
|
-----END PGP SIGNATURE-----
|