Canonicalization and directory traversal in iSeries FTP security products
Canonicalization problems in iSeries FTP security products
Overview
------------
The IBM iSeries (AS/400) server provides a unified access scheme, called
IFS,
to all of the files and to all of the database tables in all of the database
libraries.
Because the built-in FTP server provides full access to the IFS, a valid,
authenticated user,
can access and retrieve via FTP all of the database tables and all of the
files that he has
authority to access, based on the server assigned object authority.
This problem is usually addressed by third party iSeries security products
that attempt to limit FTP users only to the assets they should have access
to.
For example, these products supposedly can limit access to a folder called
/home/bp/outgoing , so while getting a file called
/home/bp/outgoing/dailysales.csv
is allowed,
getting a file called
/qsys.lib/aplibf.lib/apcaccp.file/apcaccp.mbr
is blocked.
Several iSeries security products have been found to be vulnerable to
a canonicalization attack resulting in a possible unauthorized access to
iSeries
database tables that were supposedly blocked from access.
For example, these products allows this FTP command:
Get /home/bp/outgoing/../../../qsys.lib/aplibf.lib/apcaccp.file/apcaccp.mbr
The following iSeries security vendors were approached to see whether
their products are vulnerable to this canonicalization attack.
RazLee: notified on Feb 15, fix is available.
Castlehill: notified on March 15, fix is available.
Powertech: notified on March 15, fix is available.
Bsafe: notified on March 2, vendor has no comment.
SafeStone: notified on March 15, no reply received.
NetIQ: notified on March 15, no reply received.
iSeries servers without FTP security protection are vulnerable by default.
Full explanation and technical details about the vulnerability can be found
at
http://www.venera.com/downloads/Canonicalization_problems_in_iSeries_FTP_security.pdf