Matasano Chargen - Latest Comments in This Old Vulnerability: An AIX FTP client retrospective

Re: This Old Vulnerability: An AIX FTP client retrospective

movingketz002 — Thu, 09 Jul 2009 01:26:56 -0000

I really like reading in this site.. I always learn a lot from you Dave.. Keep it up!!!

Re: This Old Vulnerability: An AIX FTP client retrospective

forever.b0rked — Tue, 30 Oct 2007 16:23:23 -0000

They did it again:

http://labs.idefense.com/intelligence/vulnerabi...

Only this time with strcpy

Re: This Old Vulnerability: An AIX FTP client retrospective

Dave G. — Fri, 17 Aug 2007 10:33:32 -0000

Roden:

The !/bin/sh issue I am referring to is a vulnerability I think I remember from the distant past. I mention that right above the listing of that set of vulnerabilities. If it did exist, it would have been fixed 10+ years ago.

Re: This Old Vulnerability: An AIX FTP client retrospective

Roden — Fri, 17 Aug 2007 06:31:12 -0000

Sorry for my hasty spelling in the previous comment.

If the ftp program is used as a non-root user in AIX 5L 5.3, then the !/bin/sh only gives a shell prompt for the non-root user.

# su - guest
$ ftp
ftp> !/bin/sh
$ id
uid=100(guest) gid=100(usr)

The problem is not so simple, but the security flaw exists.

https://www14.software.ibm.com/webapp/set2/subs...

IBM provides the following fixes:

AIX Level APAR number Availability
--------------------------------------------------------------------
5.2.0 IZ01812 10/31/2007 (subject to change)
5.3.0 IZ01813 11/27/2007 (subject to change)

AIX Version 5 APARs can be downloaded from:

http://www.ibm.com/servers/eserver/support/unix...

Re: This Old Vulnerability: An AIX FTP client retrospective

Roden — Fri, 17 Aug 2007 06:20:23 -0000

I was hoping to find something substatial, but in the end it sadly just showed the lack of knowledge of the writes part. Especially since he could not even read the documentation for ftpd: http://publib.boulder.ibm.com/infocenter/pserie...

And how can someone who claims to have read the AIX5L5.3 code, now even know that the command he propose would give root access, only give the user access as the AIX userid he used to logged in to the ftp server in the first place.

It was a dissapointingly poor article.

Re: This Old Vulnerability: An AIX FTP client retrospective

Matt — Mon, 30 Jul 2007 14:43:50 -0000

Thank you, Dave. The top half of this post really made my morning. The bottom half was pretty good, too, but the top half was inspired.

Re: This Old Vulnerability: An AIX FTP client retrospective

Dan Weber — Mon, 30 Jul 2007 08:50:10 -0000

I think the vendors of the non-Linux Unices have just decided "fuck it, no one cares."

I've had colleagues at Sun and SGI explicitly say "no one cares about security."

I kind of wonder if they're right. I have this feeling (one that I cannot prove) that most folks buying an IRIX/AIX box these days are doing so to maintain some legacy mountain of twisty passages that it would be incredibly painful to move away from. The vendors price accordingly.