search menu icon-carat-right cmu-wordmark

CERT Coordination Center

Various FTP clients fail to account for pipe (|) characters in default file names

Vulnerability Note VU#258721

Original Release Date: 2003-01-24 | Last Revised: 2003-02-05

Overview

Various FTP client implementations do not correctly handle files whose name begins with the "|" (pipe) character.

Description

Most FTP clients include a feature in which the remote filename is used as the local filename in a GET (RETR) operation. For example, many FTP clients support syntax similar to the following:

ftp> get file.name local.name
which causes the remote file file.name to be retrieved to the local client and named local.name. In a typical FTP client, if you specify

ftp> get file.name
the client will assume a local name of file.name. Furthermore, many FTP clients support an often undocumented feature that allows the contents of a remote file to be piped through a local command. For example,

ftp> get README | more
will often cause the contents of the remote file README to be piped through the local more command. This is a very widely known and often used feature, but is not well documented. Note specifically that the presence of the pipe character (|) means that the second argument to the get command is not a filename, but rather an indication to pass the contents of the remote filename through a command. Similar undocumented behavior is often present for the dash character (-), which causes the contents of the remote file to be sent to standard output.

Some FTP clients with both features present a security risk. If the name of the remote file begins with a pipe character (|), and an FTP client relies on the default local filename, the contents of the file will be piped through a command based on the name of the remote file. Specifically, the command will be the name of the remote file without the leading pipe (|) character. For example, if the remote file is named |logger, with the contents

hello, how are you

an FTP command such as

ftp> get |logger
will, on a vulnerable FTP client, cause the contents of the file (hello, how are you) to be logged to your local system log, rather than creating a local file named |logger.

In October of 1997, IBM's Emergency Response Service published a security advisory (ERS-SVA-E01-1997:009.1) detailing a vulnerability in the AIX FTP client. Quoting from ERS-SVA-E01-1997:009.1:
The ftp client can be tricked into running arbitrary commands supplied by the remote server. When the remote file begins with a pipe symbol, the ftp client will process the contents of the remote file as a shell script.

After IBM's Emergency Response Service published their bulletin, it was discovered that other vendors client FTP implementations were vulnerable as well. However, it appears not all implementations were actually fixed. Some discussion about this problem is available at

http://online.securityfocus.com/bid/396/discussion/

In 2003, this problem was discovered to have affected FTP clients that weren't fixed when the problem was originally discovered, most notably including the FTP client from MIT, which is redistributed by some operating system vendors such as Red Hat. The list of vendors below includes as "vulnerable" vendors who fixed their FTP clients in the 1997 time frame. Follow the links to individual vendor records for more detailed information.

Impact

A malicious server can execute arbitrary code on a victim FTP client.

Solution

Apply a vendor-supplied patch.

Vendor Information

258721
 

View all 55 vendors View less vendors


CVSS Metrics

Group Score Vector
Base
Temporal
Environmental

References

Acknowledgements

Thanks to Fozzy of The Hackademy Audit Project for bringing this issue to our attention.

This document was written by Ian A. Finlay & Shawn V. Hernan.

Other Information

CVE IDs: CVE-1999-0097
Severity Metric: 17.69
Date Public: 1997-10-27
Date First Published: 2003-01-24
Date Last Updated: 2003-02-05 13:42 UTC
Document Revision: 49

Sponsored by CISA.