1. Forum
  2. Usenet
  3. COMP.UNIX.BSD.FREEBSD.ANN

  • [FreeBSD-Announce] FreeBSD Security Advisory FreeBSD-SA-20:30.ftpd

    From FreeBSD Security Advisories@21:1/5 to All on Tue Sep 15 23:53:01 2020
    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA512

    ============================================================================= FreeBSD-SA-20:30.ftpd Security Advisory
    The FreeBSD Project

    Topic: ftpd privilege escalation via ftpchroot feature

    Category: core
    Module: ftpd
    Announced: 2020-09-15
    Credits: Anonymous working with Trend Micro Zero Day Initiative
    Affects: All supported versions of FreeBSD.
    Corrected: 2020-09-15 20:55:13 UTC (stable/12, 12.2-STABLE)
    2020-09-15 21:47:44 UTC (releng/12.2, 12.2-BETA1-p1)
    2020-09-15 21:47:44 UTC (releng/12.1, 12.1-RELEASE-p10)
    2020-09-15 20:56:14 UTC (stable/11, 11.4-STABLE)
    2020-09-15 21:47:44 UTC (releng/11.4, 11.4-RELEASE-p4)
    2020-09-15 21:47:44 UTC (releng/11.3, 11.3-RELEASE-p14)
    CVE Name: CVE-2020-7468

    For general information regarding FreeBSD Security Advisories,
    including descriptions of the fields above, security branches, and the following sections, please visit <URL:https://security.FreeBSD.org/>.

    I. Background

    ftpd(8) is a daemon that implements an FTP server. To restrict
    filesystem access of authenticated clients, ftpd(8) supports the
    ftpchroot(5) feature, which allows the system administrator to designate
    a root directory for each FTP user. This is implemented using the
    chroot(2) system call.

    II. Problem Description

    A ftpd(8) bug in the implementation of the file system sandbox, combined
    with capabilities available to an authenticated FTP user, can be used to
    escape the file system restriction configured in ftpchroot(5).
    Moreover, the bug allows a malicious client to gain root privileges.

    III. Impact

    A malicious FTP user can gain privileged access to an affected system.

    IV. Workaround

    No workaround is available. Systems not running ftpd(8) or not making
    use of ftpchroot(5) are not affected. Exploitation of the bug requires
    that a malicious FTP client have login access to the server. Anonymous
    access is not sufficient.

    V. Solution

    Upgrade your vulnerable system to a supported FreeBSD stable or
    release / security branch (releng) dated after the correction date.

    Perform one of the following:

    1) To update your vulnerable system via a binary patch:

    Systems running a RELEASE version of FreeBSD on the i386 or amd64
    platforms can be updated via the freebsd-update(8) utility:

    # freebsd-update fetch
    # freebsd-update install

    Restart the applicable daemons, or reboot the system.

    2) To update your vulnerable system via a source code patch:

    The following patches have been verified to apply to the applicable
    FreeBSD release branches.

    a) Download the relevant patch from the location below, and verify the
    detached PGP signature using your PGP utility.

    # fetch https://security.FreeBSD.org/patches/SA-20:30/ftpd.patch
    # fetch https://security.FreeBSD.org/patches/SA-20:30/ftpd.patch.asc
    # gpg --verify ftpd.patch.asc

    b) Apply the patch. Execute the following commands as root:

    # cd /usr/src
    # patch < /path/to/patch

    c) Recompile the operating system using buildworld and installworld as described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>.

    Restart the applicable daemons, or reboot the system.

    VI. Correction details

    The following list contains the correction revision numbers for each
    affected branch.

    Branch/path Revision
    - ------------------------------------------------------------------------- stable/12/ r365772 releng/12.2/ r365781 releng/12.1/ r365781 stable/11/ r365773 releng/11.4/ r365781 releng/11.3/ r365781
    - -------------------------------------------------------------------------

    To see which files were modified by a particular revision, run the
    following command, replacing NNNNNN with the revision number, on a
    machine with Subversion installed:

    # svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base

    Or visit the following URL, replacing NNNNNN with the revision number:

    <URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>

    VII. References

    <URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7468>

    The latest revision of this advisory is available at <URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-20:30.ftpd.asc> -----BEGIN PGP SIGNATURE-----

    iQKTBAEBCgB9FiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAl9hOJhfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEZD MEU4NzhBRTVBRkU3ODgwMjhENjM1NUQzOTc5MkY0OUVBN0U1QzIACgkQ05eS9J6n 5cJCRA//Zuuqyaim3BnR0Qs9mSI3fm37AQN9NyV0GzaP6ayAeCu7xuyzMzFD58jU SZAkrH16buh34dfelwofPSO8ZIAHZ0X6PpVWHwrTkrT8ADHCuJwEe0imG5MDDJn4 mMJSA9OVyQXgHXApnOhJ4hHMUfGF0QJvsOvPQ4f8J3J9K9pTa78HgekaNWkgpTzo eAGV+lug/UwsK//FrcyYaifZF1xl0ZKSAl6RVFVaqxxVXZGZ2txlew4I03NEfqjJ PAmviQ1p0BO5tMqVSG+/VkuYFJNyUGvuSrvUeIoQnoWljvKx5VnAq5KVCD6La1nn o5JzNEvlqzOC1ClribxALyv/VJHJt6PDBF4S26ATwIdr8TCzSpe2Byjj9KN/qC94 JuT6hScERpT4ARIsJiDIDe0+9zBeglJuS/3sJozI+ani+VL/7uBL6MB50twgioFG 4+5MNgc4VYgX35U0z+fStncZAScByXWdxaMDYx9brfZeaeEhiZA6wXYCf8kpaW94 zDOvBCH+GR1O2nALdlMVFrThQdTkq1AtMQ58Uuaxpu1LBGrMVfz/VCDEurWog+U1 7uxRwx9o6lJvno3oPQTfHkcuHZosOE0KdfdJ1Tcmj1pVZVjeaxu7HEW2H73YRhBN Fc4XIxaO7URyYwtzxzH9yU18wKCp+g/mm5apgbbcz1kBS+fR3Go=
    =zvW4
    -----END PGP SIGNATURE-----
    _______________________________________________
    freebsd-announce@freebsd.org mailing list https://lists.freebsd.org/mailman/listinfo/freebsd-announce
    To unsubscribe, send any mail to "freebsd-announce-unsubscribe@freebsd.org"

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)