A remote overflow exists in NetBSD and Mac OS X. The glob.c implementation in ftpd daemon fails to validate long pathnames resulting in a buffer overflow. With a specially crafted request, an attacker can cause arbitrary code execution resulting in a loss of integrity.

For NetBSD, upgrade to versions 3.1, 3.0, 2.1 and 2.0.x (2006-12-03) or higher, as they have been reported to fix this vulnerability. Note that this flaw was fixed in the 2006-12-03 releases without a change in version number. An upgrade is required as there are no known workarounds.

For Mac OS X, currently, there are no known workarounds or upgrades to correct this issue. However, Apple has released a patch to address this vulnerability.

• Security Tracker: 1017386
• CVE ID: 2006-6652 (see also: NVD)
• Bugtraq ID: 21377
• Secunia Advisory ID: 23178 24966
• ISS X-Force ID: 30670
• VUPEN Advisory: ADV-2007-1470
• Mail List Post: http://archives.neohapsis.com/archives/fulldisclosure/2006-11/0541.html
  http://archives.neohapsis.com/archives/fulldisclosure/2006-11/0542.html
  http://lists.apple.com/archives/Security-announce/2007/Apr/msg00001.html
  http://lists.grok.org.uk/pipermail/full-disclosure/2006-December/051009.html
• Vendor Specific Advisory URL: http://docs.info.apple.com/article.html?artnum=305391
  http://docs.info.apple.com/article.html?artnum=305445
• Other Advisory URL: http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2006-027.txt.asc
• CERT: TA07-109A

• Kevin Finisterre - kfdigitalmunition.com -