[RoLUG] Fw: NcFTP - password leaking

[Ciro Mattia Gonano]

Se utilizzate abitualmente ncftp (ma anche wget e lftp sembrano avere lo stesso
problema), occhio...

Begin forwarded message:

Date: Tue, 20 Apr 2004 00:46:10 +0100
From: Konstantin Gavrilenko <mlists@arhont.com>
To: bugtraq@securityfocus.com
Subject: NcFTP - password leaking


Arhont Ltd. - Information Security

Arhont Advisory by:	Konstantin Gavrilenko (http://www.arhont.com)
Advisory:               ncftp password not hashed in processes list
Class:			design bug
Version:		3.1.6/120, 3.1.7/120
Test platform:		Slackware 9.1, Debian unstable
Model Specific:         Other version might have the same bug
Vendor Contact Date:    13/04/2004
PD* release date:	20/04/2004


DETAILS:

ncftp client does not hash the password under certain conditions. And 
such information is made available to other users through `ps aux`

e.g.
when the link is hacked up to include username and password in one line
like ftp://testuser:testpassword@filo.dmz.arhont.com/
ncftp client is able to interpret such format and successfully
connects to the site.

root@dyno:~# ncftp ftp://testuser:testpassword@filo.dmz.arhont.com/
NcFTP 3.1.7 (Jan 07, 2004) by Mike Gleason (http://www.NcFTP.com/contact/).
Connecting to 192.168.66.102...
ProFTPD 1.2.8 Server (ProFTPD Default Installation) [filo.dmz.arhont.com]
Logging in...
User testuser logged in.
Logged in to filo.dmz.arhont.com.
Current remote directory is /home/testuser.
ncftp /home/testuser >


However, the full link is displayed in the `ps aux` output,
providing unauthorised display of the sensitive data.


root       798  0.0  0.1  2020 1064 pts/3    S    15:04   0:00 ncftp
ftp://testuser:testpassword@filo.dmz.arhont.com/
g_kos      802  0.0  0.2  3504 2476 pts/4    S    15:04   0:00 -su
g_kos     2854  0.0  0.0  2636  756 pts/4    R    15:27   0:00 ps aux


Risk Factor: High

Workarounds: Avoid using links formed in such way.

The vendor has been contacted on 13/04/2004 and has assured that issue 
will be corrected in the next ncftp release.


*According to the Arhont Ltd. policy, all of the found vulnerabilities
and security issues will be reported to the manufacturer 7 days before
releasing them to the public domains (such as CERT, BUGTRAQ, OSVDB).

If you would like to get more information about this issue, please do
not hesitate to contact Arhont team.




-- 
Respectfully,
Konstantin V. Gavrilenko

Arhont Ltd - Information Security

web:    http://www.arhont.com
	http://www.wi-foo.com
e-mail: k.gavrilenko@arhont.com

tel: +44 (0) 870 44 31337
fax: +44 (0) 117 969 0141

PGP: Key ID - 0x4F3608F7
PGP: Server - keyserver.pgp.com


-- 
Lestat de Lioncourt  -- a.k.a --  Ciro Mattia Gonano
 Undergraduate student in Computer Science at University of Bologna
 IHGGer #1049   <=>  ICQ#: 52631406   <=>   URL: http://www.CS.UniBO.It/~gonano
 Debian admin at Students.CS.UniBO.It <=> look at headers for my JabberID & GPG