Bug 117922 - ftpd(8): remote ftp user possible leave chrooted environment in 7.0-BETA2
Summary: ftpd(8): remote ftp user possible leave chrooted environment in 7.0-BETA2
Status: Closed Overcome By Events
Alias: None
Product: Base System
Classification: Unclassified
Component: bin (show other bugs)
Version: 7.0-BETA2
Hardware: Any Any
: Normal Affects Only Me
Assignee: freebsd-bugs (Nobody)
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2007-11-08 13:30 UTC by Igor Marijko
Modified: 2024-11-17 03:46 UTC (History)
0 users

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Igor Marijko 2007-11-08 13:30:01 UTC
ftpd included in FreeBSD allows remote ftp user leave chrooted (via
/etc/ftpchroot) environment within the bounds of the parition.  

Bug also present in 5.4-RELEASE and 6.2-RELEASE (and may be in other versions)

How-To-Repeat: Using default instalations,
uncoment next line in /etc/inetd.conf
ftp     stream  tcp     nowait  root    /usr/libexec/ftpd       ftpd -ll 
add line 'inetd_enable="YES"' to /etc/rc.conf

and start inetd using '/etc/rc.d/inetd start'

create new user, for example 'admin'
and add login of this user to /etc/ftpchroot

After that using any ftp client (FAR manager) connect to our ftpd as
'admin'. Create on ftp any directory and 'cd' into it.

If user been in some folder (user session root changed to /home/admin)
and in time this directory has been moved by another user outside chroot
directory (/home/admin) within the bounds of the parition (to
"/usr/local/www/data" for example). Ftp user going out directory (cd ..)
leave chroot directory and grand access to files on partition.
Comment 1 Eitan Adler freebsd_committer freebsd_triage 2017-12-31 08:01:00 UTC
For bugs matching the following criteria:

Status: In Progress Changed: (is less than) 2014-06-01

Reset to default assignee and clear in-progress tags.

Mail being skipped
Comment 2 Mark Linimon freebsd_committer freebsd_triage 2024-11-17 03:46:31 UTC
^Triage: I'm sorry that this PR did not get addressed in a timely fashion.

By now, the version that it was created against is long out of suppoprt.
Please re-open if it is still a problem on a supported version.