How to remediate – WU-FTPD fileutils/coreutils ls -w Argument Memory Consumption DoS

1. Introduction

The WU-FTPD fileutils/coreutils ls -w Argument Memory Consumption DoS vulnerability affects remote FTP servers running a vulnerable version of /bin/ls. This allows an attacker to potentially exhaust server memory, leading to a denial of service. Systems offering public or unauthenticated access are at highest risk. Impact is high on availability, with potential for moderate impact on confidentiality and integrity if exploited as part of a wider attack.

2. Technical Explanation

The vulnerability occurs because the affected WU-FTPD version does not properly filter arguments passed to the /bin/ls command. An attacker can provide excessively long arguments, specifically using the ‘-w’ option with a large number, causing ls to attempt to allocate an excessive amount of memory. This can lead to a denial of service as the server runs out of resources. CVE-2003-0853 and CVE-2003-0854 describe this issue.

• Root cause: Missing input validation on arguments passed to /bin/ls.
• Exploit mechanism: An attacker sends a command containing :ls ‘-w 1000000 -C’ to the FTP server, triggering excessive memory allocation by ls.
• Scope: WU-FTPD versions prior to those with the fix are affected.

3. Detection and Assessment

Confirming vulnerability involves checking the version of WU-FTPD and verifying that /bin/ls is susceptible to argument length exploitation.

• Quick checks: Use the command `ls -v` to display the version information for ls.
• Scanning: Nessus plugin ID 20837 may identify this vulnerability, but results should be verified manually.
• Logs and evidence: Check system logs for out-of-memory errors or crashes coinciding with FTP server activity.

ls -v

4. Solution / Remediation Steps

The primary solution is to obtain a fix from your vendor. This may involve upgrading WU-FTPD or applying a patch.

4.1 Preparation

• Ensure you have access to the vendor’s update mechanism and understand the rollback procedure in case of issues. A roll back plan is to restore from backup or revert the system snapshot.
• A change window may be required depending on your environment, with approval from the IT security team.

4.2 Implementation

1. Step 1: Download the latest version of WU-FTPD from your vendor’s website or repository.
2. Step 2: Stop the FTP service. For example, on Linux use `systemctl stop wuftpd`.
3. Step 3: Replace the existing WU-FTPD installation with the new version.
4. Step 4: Start the FTP service using `systemctl start wuftpd`.

4.3 Config or Code Example

Before

No specific configuration changes are required, but ensure you are running a patched version of WU-FTPD.

After

Verify the updated version using `ls -v`. The output should reflect the patched version number.

4.4 Security Practices Relevant to This Vulnerability

Several security practices can help mitigate this type of vulnerability.

• Practice 1: Least privilege – running services with minimal necessary permissions limits the impact if exploited.
• Practice 2: Patch cadence – regularly updating software reduces exposure to known vulnerabilities like this one.

4.5 Automation (Optional)

# Example Ansible playbook snippet - use with caution!
- name: Update WU-FTPD (example only)
  package:
    name: wuftpd
    state: latest
  become: true

5. Verification / Validation

Confirm the fix by verifying the updated version of WU-FTPD and attempting to trigger the vulnerability.

• Post-fix check: Run `ls -v` again. The output should show a patched version number.
• Re-test: Attempt to send the malicious command :ls ‘-w 1000000 -C’ to the server and verify that it does not cause a denial of service.
• Smoke test: Verify basic FTP functionality, such as file upload and download, is still working correctly.

ls -v

6. Preventive Measures and Monitoring

Proactive measures can reduce the risk of similar vulnerabilities.

• Baselines: Update security baselines to include minimum acceptable WU-FTPD versions.
• Pipelines: Integrate Static Application Security Testing (SAST) into your CI/CD pipeline to identify potential input validation issues in custom code.
• Asset and patch process: Implement a regular patch review cycle for all servers, prioritizing critical vulnerabilities like this one.

7. Risks, Side Effects, and Roll Back

Upgrading WU-FTPD may introduce compatibility issues with existing configurations.

• Risk or side effect 1: Compatibility issues – test the upgrade in a non-production environment first.
• Risk or side effect 2: Service interruption – plan for downtime during the upgrade process.
• Roll back: 1) Stop the FTP service. 2) Restore the previous WU-FTPD installation from backup. 3) Start the FTP service.

8. References and Resources

Links to relevant resources.

• Vendor advisory or bulletin: http://www.guninski.com/binls.html
• NVD or CVE entry: CVE-2003-0853
• Product or platform documentation relevant to the fix: No specific documentation available beyond vendor updates.