A local off-by-one overflow exists in WU-FTPD. The fb_realpath() function fails to validate user input resulting in a buffer overflow. With a specially crafted request, an attacker can cause arbitrary code execution resulting in a loss of integrity.

An off-by-one bug exists in fb_realpath() function. An overflow occurs when the length of a constructed path is equal to the MAXPATHLEN+1 characters while the size of the buffer is MAXPATHLEN characters only. The overflowed buffer lies on the stack. The bug results from misuse of the "rootd" variable in the calculation of length of a concatenated string.

This issue can be exploited remotely via anonymous FTP access. If your FTP server is configured to allow anonymous access, this may allow remote exploitation. If anonymous access is not allowed, this is a local issue only.

Upgrade to version 2.6.2-12 (Available on some Linux distributions) or higher, as it has been reported to fix this vulnerability. In addition, WU-FTPD Development Group has released a patch for some older versions of the primary distribution.

• ISS X-Force ID: 12785
• CVE ID: 2003-0466 (see also: NVD)
• SCIP VulDB ID: 218
• Related OSVDB ID: 6602
• Exploit Database: 74 78
• Milw0rm: 74 78
• CERT VU: 743092
• Bugtraq ID: 8315
• Secunia Advisory ID: 9406 9521 9535
• Vendor Specific Solution URL: ftp://ftp.wu-ftpd.org/pub/wu-ftpd/patches/apply_to_2.6.2/realpath.patch
• Generic Informational URL: http://isec.pl/vulnerabilities/isec-0011-wu-ftpd.txt
• Mail List Post: http://marc.theaimsgroup.com/?l=bugtraq&m=105967301604815&w=2
• Generic Exploit URL: http://marc.theaimsgroup.com/?l=bugtraq&m=106001702232325&w=2
  http://www.frsirt.com/exploits/08.11.0x82-wu262-advanced.c.php
• Vendor Specific Advisory URL: http://www.debian.org/security/2003/dsa-357
  http://www.mandrakesoft.com/security/advisories?name=MDKSA-2003:080
  http://www.suse.de/de/security/2003_032_wuftpd.html
  http://www.turbolinux.com/security/TLSA-2003-46.txt
  http://your.hp.com/m/S.asp?HB14091692265X3612511X395967
  https://rhn.redhat.com/errata/RHSA-2003-245.html
• Vendor URL: http://www.wuftpd.org/
• CIAC Advisory: n-132

• Wojciech Purczynski - cliphisec.pl - isec.pl
• Janusz Niewiadomski - funkyshisec.pl - Isec