WFTPD Vulnerabilities

Updated 6/1/01
CVE 1999-0950
CAN 2001-0296
CAN 2001-0695

Impact

A remote attacker with an account on the server could execute arbitrary commands.

Background

The File Transfer Protocol (FTP) allows a client to store or retrieve files on a server. WFTPD is an FTP server which runs on any Windows platform, allowing users to set up an FTP server on a PC.

The Problems

Buffer overflow in CWD

CVE 1999-0950
CAN 2001-0296
By exploiting a buffer overflow condition in the processing of the CWD command, it is possible for a remote user to execute arbitrary commands on the server running WFTPD. Unless the anonymous account is enabled, an attacker would need to know a valid user name and password in order to exploit the vulnerability.

WFTPD Pro 3.00 prior to release 4 is affected by this vulnerability.

Long path name buffer overflow

6/1/01
A buffer overflow in the processing of path names could allow an attacker to crash the service or execute arbitrary code by listing a directory which, together with a file name in the directory, contains a very large path name. Unless the anonymous account is enabled, an attacker would need to know a valid user name and password in order to exploit the vulnerability.

WFTPD Pro 3.00 R5 and earlier are affected by this vulnerability.

cd a:\ Denial of Service

CAN 2001-0695
By continually issuing a command to access the floppy disk drive (cd a:\), an attacker can cause a denial of service. WFTPD 3.00 R5 and earlier are affected by this vulnerability.

Resolution

The first buffer overflow can be fixed by upgrading to WFTPD Pro 3.00 R4 or higher. The second buffer overflow and denial-of-service problem can presumably be fixed by upgrading to WFTPD Pro 3.00 R6 or higher when it becomes available. Until a fix is available, restrict FTP access to the host at the firewall.

Where can I read more about this?

The vulnerability in the CWD command was posted to Bugtraq.

The long path name vulnerability was reported in Vuln-Dev.

The denial-of-service vulnerability was posted to Bugtraq.