Filter by Category

New FTP Server Security Flaw Recently Discovered

We know that FTP has security issues that are based upon its aging design. But a new flaw, discovered by Maksymilian Arciemowicz, is creating new concerns. This new flaw is calling into question the underlying code-base implemented by literally thousands of FTP server applications.

The flaw resides in several C code libraries that call the glob() function. "Globbing" is a pervasive function that permits the use of wildcard patterns to identify file names. It's one of the most commonly used processes in transferring large numbers of files with FTP: Instead of individually selecting files, a user may select a folder or a group of files based upon a common string. The common use of *.doc or *.* are examples.

The flaw discovered by Arciemowicz relates to a feature added to C libraries in 2001. That feature, called GLOB_LIMIT, was designed to limit the amount of memory used during transfer. Because GLOB_LIMIT is not effective, it potentially allows a system's main memory to be flooded when processing certain patterns and this may, depending on the hardware used, cause the system to become very slow, cease to respond or even crash as a result.

Of course, crashing an FTP server can then permit other security violations to take place - not only on the server side. For instance, a hung FTP server that is in the midst of a conversation with a client can leave the client's data in the open. This represents a serious potential security hole for the client software itself.

In most servers, the function is implemented via libc, but some vendors have integrated the globbing feature directly into their products, with an option in the configuration settings for it to be disabled. Arciemowicz said that OpenBSD 4.7, NetBSD 5.0.2, FreeBSD 7.3 / 8.1, Oracle Sun Solaris 10 and GNU Libc (glibc) are affected. FTP and SFTP servers all tend to support globbing, so it's important to either disable globbing in the configuration of the server side, and/or to contact the software vendor about the use of this underlying function to discuss how to the function.

GoAnywhere does not have this issue as it does not use C or the GLOB_LIMIT. GoAnywhere Services [renamed GoAnywhere MFT in 2015] is a secure file server that allows trading partners (both internal and external) to securely connect to your system and exchange files within a fully managed and audited solution. Popular file transfer and encryption standards are supported without the need for proprietary client software.

 

Add a Comment

Allowed tags: <b><i><br>

Latest Posts


What’s the Difference Between GoAnywhere 6.0 and 6.1?

May 20, 2019

We’re excited to share that GoAnywhere 6.1 is now available for download! The newest version of our managed file transfer solution includes over 30 new features, such as X12 data…


How to Encrypt Files in Linux

May 16, 2019

If your organization uses Linux operating systems to run key business processes, it’s important to implement tried-and-tested Linux security practices that support critical files as they…


Everything You Need to Know about FTP Automation Software

May 9, 2019

So, you want to automate your FTP file transfers. Whether you send a dozen file transfers a week, hundreds a day, or even more, automation is a smart step for most businesses. The benefits are…


How to Prevent Data Breaches with MFT | Checklist and Plan

May 2, 2019

You know what a data breach looks like in the movies. A character’s computer is suddenly overtaken by lines of green code. Windows and browsers pop up at lightening speed, as if the PC itself…


The Pros and Cons of Open Source Managed File Transfer Software

April 24, 2019

There comes a day for many companies when it’s time to implement a managed file transfer (MFT) solution. Perhaps there are new compliance requirements to meet, new relationships with third…