COMMAND
Auto_FTP.pl
SYSTEMS AFFECTED
Auto_FTP v0.02
PROBLEM
Nightfall Security Group found following. Auto_FTP.pl is a perl
script that utilizes a shared directory, anytime something new is
put into the shared directory it transfers it to the specified
ftp site. Auto_FTP is available via freshmeat.net at
http://apps.freshmeat.net/download/938443720/
Auto_FTP uses a configuration file that can be found in
/etc/auto_ftp.conf, which contains the username, password and IP
address of the remote ftp site in plain text. Thereby allowing
anyone with read access to /etc to view the login and password to
the ftp site. Another problem is that the shared directory by
default is /tmp/ftp_tmp which can be viewed by any users on the
machine. If you are transferring sensitive material with Auto_FTP
it won't be sensitive for much longer.
Auto_FTP does not check to see what user is sending to the shared
directory. Any user on the local system could copy a file to
/tmp/ftp_tmp and have it transferred to the ftp.
Auto_FTP in summary:
- Stores login and password for remote ftp in plaintext
configuration file
- Uses a shared directory to automatically transfer files that
by default can be used and viewed by anyone
- Auto_FTP does not check to see what user sent a specific
file to the shared directory, therefore allowing anyone to
copy a file to the shared directory and have it transferred
to the ftp. (The default shared directory is /tmp/ftp_tmp).
In conclusion this program while it may be a good idea does not
concern itself with security precautions and is therefore not
reccomended when the contents of the data is important. Reminder,
plaintext passwords in a file that can be viewed by anyone is
never a good idea.
SOLUTION
Author Joshua Curtis has made significant updates and improvments
to the utility. Auto_FTP v0.03 now:
- Creates a random directory in a directory structure your specify
to transfer files from
- The program will now check auto_ftp.conf to verify that the
owner is correct, if it is not it will not send the file and
will alert root
- You can define users who can utilize the program
- The documentation also includes on how to make auto_ftp.conf not
readable by everyone