-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-20:30.ftpd Security Advisory The FreeBSD Project Topic: ftpd privilege escalation via ftpchroot feature Category: core Module: ftpd Announced: 2020-09-15 Credits: Anonymous working with Trend Micro Zero Day Initiative Affects: All supported versions of FreeBSD. Corrected: 2020-09-15 20:55:13 UTC (stable/12, 12.2-STABLE) 2020-09-15 21:47:44 UTC (releng/12.2, 12.2-BETA1-p1) 2020-09-15 21:47:44 UTC (releng/12.1, 12.1-RELEASE-p10) 2020-09-15 20:56:14 UTC (stable/11, 11.4-STABLE) 2020-09-15 21:47:44 UTC (releng/11.4, 11.4-RELEASE-p4) 2020-09-15 21:47:44 UTC (releng/11.3, 11.3-RELEASE-p14) CVE Name: CVE-2020-7468 For general information regarding FreeBSD Security Advisories, including descriptions of the fields above, security branches, and the following sections, please visit . I. Background ftpd(8) is a daemon that implements an FTP server. To restrict filesystem access of authenticated clients, ftpd(8) supports the ftpchroot(5) feature, which allows the system administrator to designate a root directory for each FTP user. This is implemented using the chroot(2) system call. II. Problem Description A ftpd(8) bug in the implementation of the file system sandbox, combined with capabilities available to an authenticated FTP user, can be used to escape the file system restriction configured in ftpchroot(5). Moreover, the bug allows a malicious client to gain root privileges. III. Impact A malicious FTP user can gain privileged access to an affected system. IV. Workaround No workaround is available. Systems not running ftpd(8) or not making use of ftpchroot(5) are not affected. Exploitation of the bug requires that a malicious FTP client have login access to the server. Anonymous access is not sufficient. V. Solution Upgrade your vulnerable system to a supported FreeBSD stable or release / security branch (releng) dated after the correction date. Perform one of the following: 1) To update your vulnerable system via a binary patch: Systems running a RELEASE version of FreeBSD on the i386 or amd64 platforms can be updated via the freebsd-update(8) utility: # ..
Support the originator by clicking the read the rest link below.
