How to remediate – WU-FTPD SITE NEWER Command Memory Exhaustion DoS

1. Introduction

The WU-FTPD SITE NEWER Command Memory Exhaustion Denial of Service vulnerability affects FTP servers running the WU-FTPD software. An attacker can send a specially crafted command to consume all available memory on the server, causing it to become unresponsive. This impacts availability and could lead to service outages. Systems running older versions of WU-FTPD are most at risk. The likely impact is high availability disruption with low impact on confidentiality or integrity.

2. Technical Explanation

The vulnerability occurs because the WU-FTPD server does not properly limit the resources used when processing the ‘SITE NEWER’ command. An attacker can repeatedly send this command, causing the server to allocate increasing amounts of memory until it is exhausted. This leads to a denial of service condition. The CVE associated with this issue is CVE-1999-0880.

• Root cause: Insufficient resource limits on processing the ‘SITE NEWER’ command.
• Exploit mechanism: An attacker sends multiple ‘SITE NEWER’ commands to the FTP server, triggering excessive memory allocation. For example, an attacker could use a simple script to repeatedly connect and issue the command.
• Scope: Affected platforms are those running WU-FTPD versions prior to 2.6.0.

3. Detection and Assessment

You can confirm if your system is vulnerable by checking the version of WU-FTPD installed. A thorough assessment involves monitoring server memory usage during ‘SITE NEWER’ command processing.

• Quick checks: Use the following command to check the WU-FTPD version: wuftpd -v
• Scanning: Nessus plugin ID 10872 may identify vulnerable versions. This is an example only.
• Logs and evidence: Check system logs for out of memory errors or FTP server crashes coinciding with ‘SITE NEWER’ command activity. Look in /var/log/syslog or similar depending on your distribution.

wuftpd -v

4. Solution / Remediation Steps

The primary solution is to update to the latest version of WU-FTPD. If you are using an older version, upgrade to at least 2.6.0.

4.1 Preparation

• Ensure you have a rollback plan in place by retaining the original configuration files and installation media.
• A change window may be required depending on your business needs. Approval from the IT security team is recommended.

4.2 Implementation

1. Step 1: Download the latest version of WU-FTPD from a trusted source.
2. Step 2: Stop the existing FTP service. For example, using systemctl: sudo systemctl stop wuftpd
3. Step 3: Install the new version of WU-FTPD. The exact method depends on your operating system and package manager.
4. Step 4: Configure the new installation with your existing configuration files.
5. Step 5: Start the updated FTP service: sudo systemctl start wuftpd

4.3 Config or Code Example

Before

# No specific configuration changes are required, but older versions are vulnerable.

After

# Ensure WU-FTPD version is 2.6.0 or later: wuftpd -v

4.4 Security Practices Relevant to This Vulnerability

Several security practices can help mitigate this type of vulnerability. Patch management ensures timely updates, and least privilege limits the impact if a service is compromised.

• Practice 1: Implement a regular patch cadence for all server software to address known vulnerabilities quickly.
• Practice 2: Apply the principle of least privilege by running services with minimal necessary permissions. This reduces the potential damage from an exploited vulnerability.

4.5 Automation (Optional)

# Example Ansible task to update WU-FTPD (example only - adapt for your environment)
- name: Update WU-FTPD
  apt:
    name: wuftpd
    state: latest
  become: yes

5. Verification / Validation

Confirm the fix by checking the updated version of WU-FTPD and verifying that the server can handle ‘SITE NEWER’ commands without crashing or exhausting memory.

• Post-fix check: Run wuftpd -v to confirm the version is 2.6.0 or later.
• Re-test: Repeat the initial vulnerability assessment steps (monitoring memory usage during ‘SITE NEWER’ command processing) and ensure no issues occur.
• Smoke test: Verify that users can still connect to the FTP server and upload/download files normally.
• Monitoring: Monitor system logs for any errors related to WU-FTPD or excessive memory usage.

wuftpd -v

6. Preventive Measures and Monitoring

Regular security baselines and vulnerability scanning can help prevent similar issues in the future. A robust patch management process is also essential.

• Baselines: Update your server security baseline to include a requirement for running the latest versions of all software, including WU-FTPD.
• Asset and patch process: Implement a regular patch review cycle (e.g., weekly or monthly) to ensure timely application of security updates.

7. Risks, Side Effects, and Roll Back

• Risk or side effect 1: Compatibility issues with custom FTP scripts or clients. Mitigation: Test thoroughly in a non-production environment first.
• Risk or side effect 2: Service downtime during the update process. Mitigation: Schedule updates during off-peak hours.
• Roll back:
  1. Step 1: Stop the updated FTP service.
  2. Step 2: Restore your original WU-FTPD configuration files.
  3. Step 3: Reinstall the previous version of WU-FTPD from your backup media.
  4. Step 4: Start the original FTP service.

8. References and Resources

• Vendor advisory or bulletin: https://seclists.org/bugtraq/1999/Oct/212
• NVD or CVE entry: CVE-1999-0880
• Product or platform documentation relevant to the fix: No specific documentation available.