bugtraq - Canonicalization and directory traversal in iSeries FTP security products

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date: Thu, 21 Apr 2005 02:43:29 +0300
From: "Shalom Carmel" <shalom@...era.com>
To: "bugtraq" <bugtraq@...urityfocus.com>
Subject: Canonicalization and directory traversal in iSeries FTP security products

Canonicalization problems in iSeries FTP security products

Overview
------------
The IBM iSeries (AS/400) server provides a unified access scheme, called
IFS,
to all of the files and to all of the database tables in all of the database
libraries.

Because the built-in FTP server provides full access to the IFS, a valid,
authenticated user,
can access and retrieve via FTP all of the database tables and all of the
files that he has
authority to access, based on the server assigned object authority.

This problem is usually addressed by third party iSeries security products
that attempt to limit FTP users only to the assets they should have access
to.

For example, these products supposedly can limit access to a folder called
/home/bp/outgoing , so while getting a file called
/home/bp/outgoing/dailysales.csv
is allowed,
getting a file called
/qsys.lib/aplibf.lib/apcaccp.file/apcaccp.mbr
is blocked.

Several iSeries security products have been found to be vulnerable to
a canonicalization attack resulting in a possible unauthorized access to
iSeries
database tables that were supposedly blocked from access.

For example, these products allows this FTP command:

Get /home/bp/outgoing/../../../qsys.lib/aplibf.lib/apcaccp.file/apcaccp.mbr

The following iSeries security vendors were approached to see whether
their products are vulnerable to this canonicalization attack.

RazLee: notified on Feb 15, fix is available.
Castlehill: notified on March 15, fix is available.
Powertech: notified on March 15, fix is available.
Bsafe: notified on March 2, vendor has no comment.
SafeStone: notified on March 15, no reply received.
NetIQ: notified on March 15, no reply received.

iSeries servers without FTP security protection are vulnerable by default.

Full explanation and technical details about the vulnerability can be found
at
http://www.venera.com/downloads/Canonicalization_problems_in_iSeries_FTP_security.pdf