3 ms·

the serv-u thing looks like a misconfiguration to me. i'd be curious how many installs in the wild are actually vulnerable. ie. 1) was there a previous instal

by a-dub 6y ago

the serv-u thing looks like a misconfiguration to me. i'd be curious how many installs in the wild are actually vulnerable. ie. 1) was there a previous install process that did set correct permissions for the access list tree? 2) did sites secure the access list tree themselves after install/security review? the msmq thing isn't great, but any professionally managed site would be protecting/firewalling application level sockets anyhow. not to say the bugs aren't real, they are, just wondering how much exposure they actually open up in the wild when combined with basic security hygiene.

tyingq 6y ago
Their hotfix seems to acknowledge that the software is specifically setting weak ACLs on that C:\Program Data\RhinoSoft\Serv-U\Users directory. You're right that end users should do "2)", but I imagine it's pretty common to just run the installer.
- a-dub 6y ago
  the name of the previous developer (rhinosoft) of the software appears in the directory tree, which would lead me to guess that maybe the original installer did set correct ACLs but when ported to the new post-acquisition solarwinds installer, that was maybe dropped. (just a guess) i dunno how modern windows admin is done, but the last time i worked with it it was common for large sites to use deployment automation and do repackaging, even if was less sophisticated than what you'd see in unixland.
john37386 6y ago
You can maybe ask shodan? https://www.shodan.io/search?query=serv-u https://www.shodan.io/search?query=serv-u
- ficklepickle 6y ago
  220 Serv-U FTP Server v6.3 for WinSock ready... https://www.shodan.io/search?query=serv-u+ftp https://www.shodan.io/search?query=serv-u+ftp
DharmaPolice 6y ago
My organisation uses Serv-U. The permissions in our programdata folder matches the article (we've not applied the most recent Serv-U patch which came out quite recently). But as the article says you need to be RDP'd to the server which for us would be Administrators. Who already have control over the server. Also we don't run the service as local system just as a regular service account with no admin rights. So while this is a vulnerability it doesn't seem overly critical in our case. If you let non-privileged users RDP to your application servers and you're running as local system then sure, it's pretty bad.

by a-dub 6y ago

tyingq 6y ago

Their hotfix seems to acknowledge that the software is specifically setting weak ACLs on that C:\Program Data\RhinoSoft\Serv-U\Users directory. You're right that end users should do "2)", but I imagine it's pretty common to just run the installer.

a-dub 6y ago
the name of the previous developer (rhinosoft) of the software appears in the directory tree, which would lead me to guess that maybe the original installer did set correct ACLs but when ported to the new post-acquisition solarwinds installer, that was maybe dropped. (just a guess) i dunno how modern windows admin is done, but the last time i worked with it it was common for large sites to use deployment automation and do repackaging, even if was less sophisticated than what you'd see in unixland.

john37386 6y ago

You can maybe ask shodan? https://www.shodan.io/search?query=serv-u https://www.shodan.io/search?query=serv-u

ficklepickle 6y ago
220 Serv-U FTP Server v6.3 for WinSock ready... https://www.shodan.io/search?query=serv-u+ftp https://www.shodan.io/search?query=serv-u+ftp

DharmaPolice 6y ago

My organisation uses Serv-U. The permissions in our programdata folder matches the article (we've not applied the most recent Serv-U patch which came out quite recently). But as the article says you need to be RDP'd to the server which for us would be Administrators. Who already have control over the server. Also we don't run the service as local system just as a regular service account with no admin rights. So while this is a vulnerability it doesn't seem overly critical in our case. If you let non-privileged users RDP to your application servers and you're running as local system then sure, it's pretty bad.