Tutorial - WFTPD Vulnerabilities

##
WFTPD Vulnerabilities

Updated 6/1/01

### Impact

A remote attacker with an account on the server could execute arbitrary commands.

### Background

The File Transfer Protocol (`FTP`) allows a client to store or retrieve files on a server. WFTPD is an FTP server which runs on any Windows platform, allowing users to set up an FTP server on a PC.

### The Problems

Buffer overflow in `CWD`

By exploiting a buffer overflow condition in the processing of the `CWD` command, it is possible for a remote user to execute arbitrary commands on the server running `WFTPD`. Unless the anonymous account is enabled, an attacker would need to know a valid user name and password in order to exploit the vulnerability.

WFTPD Pro 3.00 prior to release 4 is affected by this vulnerability.

Long path name buffer overflow

6/1/01
A buffer overflow in the processing of path names could allow an attacker to crash the service or execute arbitrary code by listing a directory which, together with a file name in the directory, contains a very large path name. Unless the anonymous account is enabled, an attacker would need to know a valid user name and password in order to exploit the vulnerability.

WFTPD Pro 3.00 R5 and earlier are affected by this vulnerability.

### Resolution

The first buffer overflow can be fixed by upgrading to WFTPD Pro 3.00 R4 or higher. The second buffer overflow can presumably be fixed by upgrading to WFTPD Pro 3.00 R6 or higher when it becomes available. Until a fix is available, restrict FTP access to the host at the firewall.

### Where can I read more about this?

The vulnerability in the `CWD` command was posted to Bugtraq.

The long path name vulnerability was reported in Vuln-Dev.