New vulnerability in wu-ftpd (CAN-2004-0148)
Rajesh Somasundaran <[email protected]> Fri, 19 Mar 2004 19:16:59 +0530
| Newsgroups | gmane.network.ftp.wuftpd.user,gmane.network.ftp.wuftpd.devel |
|---|---|
| Organization | Hewlett Packard - ISO, Bangalore, India. |
| Message-ID | <[email protected]> |
--------------080109050506020406090508 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Hello, I saw a new security vulnerability reported on wu-ftpd (CERT advisory note CAN-2004-0148). I read it from http://www.cert-ist.com/english/advisories/listeavis_en.htm along with the s/key vulnerability. CAN-2004-0148 Description: wu-ftpd 2.6.2 and earlier, with the restricted-gid option enabled, allows local users to bypass access restrictions by changing the permissions to prevent access to their home directory, which causes wu-ftpd to use the root directory instead. Is there any patch available for this vulnerability? I couldn't see any in www.wu-ftpd.org !!! Thanks, Rajesh. --------------080109050506020406090508 Content-Type: text/html; charset=us-ascii Content-Transfer-Encoding: 7bit <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <meta http-equiv="Content-Type" content="text/html;charset=ISO-8859-1"> <title></title> </head> <body> Hello,<br> <br> I saw a new security vulnerability reported on wu-ftpd (CERT advisory note CAN-2004-0148). I read it from <a class="moz-txt-link-freetext" href="http://www.cert-ist.com/english/advisories/listeavis_en.htm">http://www.cert-ist.com/english/advisories/listeavis_en.htm</a> along with the s/key vulnerability. <br> <br> CAN-2004-0148 <font size="2" face="Verdana, Arial, Helvetica, Geneva">Description: </font> <font size="2" face="Verdana, Arial, Helvetica, Geneva">wu-ftpd 2.6.2 and earlier, with the restricted-gid option enabled, allows local users to bypass access restrictions by changing the permissions to prevent access to their home directory, which causes wu-ftpd to use the root directory instead.</font><br> <br> Is there any patch available for this vulnerability? I couldn't see any in <a class="moz-txt-link-abbreviated" href="http://www.wu-ftpd.org">www.wu-ftpd.org</a> !!!<br> <br> Thanks,<br> Rajesh.<br> </body> </html> --------------080109050506020406090508--