NcFTP - password leaking
Arhont Ltd. - Information Security
Arhont Advisory by: Konstantin Gavrilenko (http://www.arhont.com)
Advisory: ncftp password not hashed in processes list
Class: design bug
Version: 3.1.6/120, 3.1.7/120
Test platform: Slackware 9.1, Debian unstable
Model Specific: Other version might have the same bug
Vendor Contact Date: 13/04/2004
PD* release date: 20/04/2004
DETAILS:
ncftp client does not hash the password under certain conditions. And
such information is made available to other users through `ps aux`
e.g.
when the link is hacked up to include username and password in one line
like ftp://testuser:testpassword@xxxxxxxxxxxxxxxxxxx/
ncftp client is able to interpret such format and successfully
connects to the site.
root@dyno:~# ncftp ftp://testuser:testpassword@xxxxxxxxxxxxxxxxxxx/
NcFTP 3.1.7 (Jan 07, 2004) by Mike Gleason (http://www.NcFTP.com/contact/).
Connecting to 192.168.66.102...
ProFTPD 1.2.8 Server (ProFTPD Default Installation) [filo.dmz.arhont.com]
Logging in...
User testuser logged in.
Logged in to filo.dmz.arhont.com.
Current remote directory is /home/testuser.
ncftp /home/testuser >
However, the full link is displayed in the `ps aux` output,
providing unauthorised display of the sensitive data.
root 798 0.0 0.1 2020 1064 pts/3 S 15:04 0:00 ncftp
ftp://testuser:testpassword@xxxxxxxxxxxxxxxxxxx/
g_kos 802 0.0 0.2 3504 2476 pts/4 S 15:04 0:00 -su
g_kos 2854 0.0 0.0 2636 756 pts/4 R 15:27 0:00 ps aux
Risk Factor: High
Workarounds: Avoid using links formed in such way.
The vendor has been contacted on 13/04/2004 and has assured that issue
will be corrected in the next ncftp release.
*According to the Arhont Ltd. policy, all of the found vulnerabilities
and security issues will be reported to the manufacturer 7 days before
releasing them to the public domains (such as CERT, BUGTRAQ, OSVDB).
If you would like to get more information about this issue, please do
not hesitate to contact Arhont team.
--
Respectfully,
Konstantin V. Gavrilenko
Arhont Ltd - Information Security
web: http://www.arhont.com
http://www.wi-foo.com
e-mail: k.gavrilenko@xxxxxxxxxx
tel: +44 (0) 870 44 31337
fax: +44 (0) 117 969 0141
PGP: Key ID - 0x4F3608F7
PGP: Server - keyserver.pgp.com