Executive brief
wu-ftpd is a widely used file transfer service. A flaw in how it handles interrupted file transfers allows an attacker to trick the server into maintaining administrative (root) privileges. This can be exploited to read sensitive files on the server that should otherwise be protected.
Technical details
A race condition exists in wu-ftpd 2.4 involving signal handling during file transfers. When a user aborts a transfer, the server may receive both a SIGPIPE (from a closed data connection) and a SIGURG (from an ABOR command). The SIGPIPE handler elevates privileges to root (uid 0) to perform cleanup tasks like updating log files. If a SIGURG is handled via longjmp() while the server is in this elevated state, it returns to the main command loop without dropping privileges. An attacker can then execute commands with root authority, such as reading any file on the filesystem. The vulnerability is mitigated by ensuring signals are suspended during privilege elevation or by resetting the transfer flag before cleanup.
Affected products
- Washington University wu-ftpd 2.4
Timeline
- 1997-01-02: disclosed: Initial discovery and report by David Greenman
- 1997-01-04: advisory: Public disclosure on Bugtraq by Aleph One
- 1997-07-04: advisory: NVD publication date