Quantum Secular Labs / Blog / Advisories

CVE-2003-0041: Mit Kerberos FTP Client: Remote code execution

CVE-2003-0041 has a CVSS v2 base score of 10.0 (the maximum on that scale) and affects Mit Kerberos FTP Client, along with 3 other products in NVD’s configuration data. Per its scoring, it can be exploited over the network, without authentication. The scored impact on confidentiality, integrity and availability is the highest available.

Vulnerability description

Kerberos FTP client allows remote FTP sites to execute arbitrary code via a pipe (|) character in a filename that is retrieved by the client.

Severity breakdown

CVSS v2.0 10.0: AV:N/AC:L/Au:N/C:C/I:C/A:C

• Access vector: Network. Exploitable remotely over the network.
• Access complexity: Low. No special conditions are required.
• Authentication: None. No authentication is needed.
• Confidentiality impact: Complete. Total information disclosure.
• Integrity impact: Complete. Total loss of integrity.
• Availability impact: Complete. Total shutdown of the component.

Underlying weakness

CWE-78: Improper Neutralization of Special Elements used in an OS Command

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command before it is sent to a downstream component.

Affected products

• Mit Kerberos FTP Client: all versions listed by NVD
• Red Hat Linux: 6.2; 7.0; 7.1; 7.2; 7.3; 8.0
• Mandrakesoft Mandrake Multi Network Firewall: 8.2
• Mandrakesoft Mandrake Linux: 8.1; 8.2; 9.0

References

• http://www.redhat.com/support/errata/RHSA-2003-020.html
• http://www.mandriva.com/security/advisories?name=MDKSA-2003:021
• http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0047.html
• http://secunia.com/advisories/7979
• http://secunia.com/advisories/8114