|
AFTPD Home Directory Change Core Dump Vulnerability
AFTPD is an alternate FTP daemon used on some UNIX Operating systems. A problem with AFTPD has been discovered that could allow a remote user to gain elevated privileges. The problem is in the handling of input. The problem presents itself when a user accesses the ftp server via any type of user account (regular, or anonymous). A user attempting to change to the user's specified home directory via a tilde (~) may crash the ftp server, creating a core file in the CWD. Upon connecting to the server and deliberately failing to authenticate as a user, this could force loading of the entire password file into system memory. The core file would then contain the encrypted passwords. This makes it possible for a remote user with anonymous access to gain access to sensitive information, and could lead to elevated privileges. |
|
 Privacy Statement |
