CVE-2000-0462: Low severity netbsd netbsd vulnerability
ftpd in NetBSD 1.4.2 does not properly parse entries in /etc/ftpchroot and does not chroot the specified users, which allows those users to access other files outside of their home directory.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
NetBSD ftpd (1.4.2)from your environment.Uninstall or disable the ftpd daemon on affected hosts if FTP service is not required, to prevent users from escaping their expected directory boundaries.
- Configuration
Remove users from /etc/ftpchroot and do not rely on /etc/ftpchroot to restrict users until an upstream fix is available; ensure users are not granted FTP chroot privileges via this file.
NetBSD ftpd (1.4.2) /etc/ftpchroot entries = remove / do not rely on this mechanism - Compensating control
Disable or restrict access to the ftpd service until the issue is fixed: stop/disable the ftpd daemon, block FTP (TCP/21) at network perimeter or limit access to trusted IP addresses only.
- Operational
Audit /etc/ftpchroot and affected user accounts to identify any users who may have had access outside their home directories; remove FTP access for impacted accounts and review file access for possible data exposure.
Event History
Frequently Asked Questions
What is the severity of CVE-2000-0462?
CVE-2000-0462 has a medium severity rating due to its potential to allow users to access files outside their designated home directories.
How do I fix CVE-2000-0462?
To fix CVE-2000-0462, ensure that the entries in /etc/ftpchroot are properly parsed and restrict user access correctly.
Which software versions are affected by CVE-2000-0462?
CVE-2000-0462 affects NetBSD version 1.4.2 across multiple architectures including alpha, arm32, sparc, and x86.
What types of vulnerabilities does CVE-2000-0462 represent?
CVE-2000-0462 represents a directory traversal vulnerability due to improper parsing in the ftpd service.
Are there any known exploits for CVE-2000-0462?
Yes, there may be known exploits for CVE-2000-0462 that allow unauthorized access to restricted file paths.