NetBSD Security Advisory 2023-007: multiple vulnerabilities in ftpd(8)

[NetBSD Security-Officer <security-officer%netbsd.org@localhost>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

		 NetBSD Security Advisory 2023-007
		 =================================

Topic:	multiple vulnerabilities in ftpd(8)

Version:	NetBSD-current:		affected prior to 2023-10-01
		NetBSD 10.0_BETA:	affected prior to 2023-10-01
		NetBSD 9.3:		affected
		NetBSD 9.2:		affected
		NetBSD 9.1:		affected
		NetBSD 9.0:		affected
		NetBSD 8.2:		affected
		NetBSD 8.1:		affected
		NetBSD 8.0:		affected
		tnftpd:			prior to tnftpd-20231001

Severity: Remote unauthenticated attacker may get directory listing, potential
buffer overflows.

Fixed:		NetBSD-current:		2023-09-30
		NetBSD-10 branch:	2023-10-02
		NetBSD-9 branch:	2023-10-02
		NetBSD-8 branch:	2023-10-03
		tnftpd:			tnftpd-20231001

Please note that NetBSD releases prior to 8.2 are no longer supported.
It is recommended that all users upgrade to a supported release.


Abstract
========

A vulnerability in the NetBSD FTP server allows unauthenticated
users to execute MLST and MLSD commands without authentication.
This can lead to information leakage - unauthorized party may be
able to download the listing of the current ftpd(8) directory. This
vulnerability has been assigned CVE-2023-45198.

Additionally, potential buffer overflow in count_users() and reading
outside of allocated memory issues due to wrong struct type used
in the pam_set_item() call have been identified.

Technical Details
=================

The NetBSD FTP server had a security flaw that allowed unauthenticated
users to execute MLST and MLSD commands without requiring proper
authentication. This could enable unauthorized users to retrieve
directory listings and information about files on the server,
potentially leading to an information leak. It should be noted that
MLST and MLSD commands can be executed by unauthenticated user, it
allows attacker to operate only on the current directory of the
ftpd(8) process.

Another issue is associated with count_users() function which
potentially used uninitialized memory. If the file was previously
empty, pids table used by the daemon is not set, the code however
used pids[0] which is uninitialized in this case. In some scenarios
it may lead to propagate garbage value from pids[0] to the file
and cause writing outside of allocated memory.

Additionally two other weaknesses have been identified. pam_set_item
used with the PAM_SOCKADDR option expects sockaddr_storage structure.
Instead, internal struct sockinet was used. Because it's length is
shorter than sockaddr_storage, libpam was copying also memory
outside of sockinet struct.

Solutions and Workarounds
=========================

As a temporary workaround, ftpd(8) might be disabled.

To apply a fixed version from a releng build, fetch a fitting base.tgz
from nycdn.NetBSD.org and extract the fixed binaries:

cd /var/tmp
ftp https://nycdn.NetBSD.org/pub/NetBSD-daily/REL/BUILD/ARCH/binary/sets/base.tgz
tar -C / -xzpf /var/tmp/base.tgz ./usr/libexec/ftpd

with the following replacements:
REL   = the release version you are using
BUILD = the source date of the build. %DATE%* and later will fit
ARCH  = your system's architecture

The following instructions describe how to upgrade your ftpd(8)
binaries by updating your source tree and rebuilding and installing
a new version of ftpd(8).

* NetBSD-current:

	Systems running NetBSD-current dated from before 2023-09-30
	should be upgraded to NetBSD-current dated 2023-10-01 or later.

	The following files/directories need to be updated from the
	netbsd-current CVS branch (aka HEAD):
		src/libexec/ftpd

	To update from CVS, re-build, and re-install ftpd(8):

		# cd src
		# cvs update -d -P src/libexec/ftpd
		# cd src/libexec/ftpd
		# make USETOOLS=no cleandir dependall
		# make USETOOLS=no install

* NetBSD 9.*:

	Systems running NetBSD 9.* sources dated from before
	2023-10-02 should be upgraded from NetBSD 9.* sources dated
	2023-10-03 or later.

	The following files/directories need to be updated from the
	netbsd-9 branch:
		src/libexec/ftpd

	To update from CVS, re-build, and re-install ftpd(8):

		# cd src
		# cvs update -r netbsd-9 -d -P src/libexec/ftpd
		# cd src/libexec/ftpd
		# make USETOOLS=no cleandir dependall
		# make USETOOLS=no install

* NetBSD 8.*:

	Systems running NetBSD 8.* sources dated from before
	2023-10-03 should be upgraded from NetBSD 8.* sources dated
	2013-10-04 or later.

	The following files/directories need to be updated from the
	netbsd-8 branch:
		src/libexec/ftpd

	To update from CVS, re-build, and re-install ftpd(8):

		# cd src
		# cvs update -r netbsd-8 -d -P src/libexec/ftpd
		# cd path/to/files
		# make USETOOLS=no cleandir dependall
		# make USETOOLS=no install

* tnftpd (or older installations):

	Rebuild tnftpd from sources. The tnftpd-20231001 distribution is at:
        https://cdn.netbsd.org/pub/NetBSD/misc/tnftp/tnftpd-20231001.tar.gz
        https://cdn.netbsd.org/pub/NetBSD/misc/tnftp/tnftpd-20231001.tar.gz.asc

Thanks To
=========

Mateusz Kocielski (shm@) who analyzed this problem and supplied the fixes.
Luke Mewburn (lukem@) and Taylor R Campbell (riastradh@) for reviewing patches.

Revision History
================

	2023-11-16	Initial release

More Information
================

Advisories may be updated as new information becomes available.
The most recent version of this advisory (PGP signed) can be found at

	https://cdn.NetBSD.org/pub/NetBSD/security/advisories/NetBSD-SA2023-007.txt.asc

Information about NetBSD and NetBSD security can be found at

	https://www.NetBSD.org/
	https://www.NetBSD.org/Security/

Copyright 2023, The NetBSD Foundation, Inc.  All Rights Reserved.
Redistribution permitted only in full, unmodified form.
-----BEGIN PGP SIGNATURE-----

iQJQBAEBCAA6FiEEJxEzJivzXLUNT1BGiSYeF/XvSf8FAmVWMZEcHHNlY3VyaXR5
LW9mZmljZXJAbmV0YnNkLm9yZwAKCRCJJh4X9e9J/wOlD/9koL3r4jHb8IPrZ+rU
R6f2AfAG2KMx9Yg/H+aMIarEfKLlKKH+wi8Jig78hyfTygbOZ13MFyl7LF2cdvA6
IOPCnuxU9F+5V19o+R6OcQdcUklQMX0zxRWVc0rx6qTGJcW8LkzghbNM6/hwLLqc
iSh0AOxhg8/xoF8HkUYljggJrQLwHReqjkdPFITn26lhKGIwbKEQ6Put46YLob1b
fqZ5A5qdtRsV0PWIMIq+j9PMiAnspXrfYc4wHy2DhiPYY6wm4h3d5HqMN8SCPluI
RjQNcxRgjwyZ8GqQQswEJCkzyya63ecrSj6ZrvGoQAAoRcEXUp9T5zez7UwiCgBm
A6uv/VBgvmglGw+nnQX1JObMFjB80P3Rs0FBBH9IZfKuzSG1Ms+nd79RwWVQ+Y8T
CZwnDAYQiHKeDpDMqTNaUq0ujOrCS2vd5xlrnRJd8wh5/kAOjTGpS0jtH9Ao1fKp
BQbrX+utvJMgCI5ztp0QHLlvPeA55Kr6bxGr7qlhTX654EiAs2KzsAEOX+pUi17P
kLLC71jhNUgCnmJOEOT9V+w2cvpgvC2W10BZDgJgS9kGfcf2j0h/s+gPuICKbUaa
xNjT4kAD7dkvVpzy9waJ7lygpeslsyuU5w6Uxl9N+CCufBktFmDZGVKhlt5LPxVA
twuKtferm7A+RI7ac9ut86F5Hw==
=MshM
-----END PGP SIGNATURE-----