Bugtraq mailing list archives
Re: [RHSA-2000:039-02] remote root exploit (SITE EXEC) fixed (fwd)
From: costan () COMM2000 IT (Andrea Costantino)
Date: Thu, 29 Jun 2000 21:39:50 +0200
On Thu, 29 Jun 2000, Joey Maier wrote:
RHSA-2000:039-02: remote root exploit (SITE EXEC) fixed[...]A security bug in wu-ftpd can permit remote users, even without an account, to gain root access. The new version closes the hole. 2. Relevant releases/architectures: Red Hat Linux 5.2 - i386 alpha sparc(which includes wu-ftpd-2.4.2b18-2.i386.rpm)Red Hat Linux 6.2 - i386 alpha sparc(which includes wu-ftpd-2.6.0-3.i386.rpm) What about Red Hat 6.0 (includes wu-ftpd-2.4.2vr17-3.i386.rpm) and 6.1 (includes wu-ftpd-2.5.0-9.i386.rpm)? I know that the sploit tf8 released was for version 2.6.0, but earlier versions of wu-ftpd are vunerable, too. Does anyone know if Red Hat plans to release RPMs to fix the 2.5.0 version included in Red Hat 6.1?
If u go to ftp://updates.redhat.com/pub/6.1 u'll find the same RPM for the 6.2 distribution. That is: wu-ftpd-2.6.0-14.6x.i386.rpm The package works perfectly on my systems, even if I didn't checked the SITE EXEC exploit on it. I suppose that the RH people doesn't lies :) . Baciamo le mani, k0 ------------------------------------------------------------------------ PER IL RE! NEL VOSTRO ONORE! (il pupetto di WarCraft II) ------------------------------------------------------------------------
Current thread:
- Re: rh 6.2 - gid compromises, etc [+ MORE!!!], (continued)
- Re: rh 6.2 - gid compromises, etc [+ MORE!!!] Wietse Venema (Jun 23)
- Re: rh 6.2 - gid compromises, etc Stan Bubrouski (Jun 22)
- Allaire Security Bulletin (ASB00-15)- Workaround available for vu lnerabilities exposed by JRun 2.3.x code sample Jesse Noller (Jun 22)
- [RHSA-2000:038-01] Zope update bugzilla () REDHAT COM (Jun 22)
- FreeBSD Security Advisory: FreeBSD-SA-00:23.ip-options FreeBSD Security Advisories (Jun 22)
- Re: FreeBSD Security Advisory: FreeBSD-SA-00:23.ip-options yeti (Jan 13)
- Re: rh 6.2 - gid compromises, etc Stan Bubrouski (Jun 22)
- [SECURITY] New Debian wu-ftpd packages released Daniel Jacobowitz (Jun 23)
- Re: [RHSA-2000:039-02] remote root exploit (SITE EXEC) fixed (fwd) Joey Maier (Jun 29)
- Re: [RHSA-2000:039-02] remote root exploit (SITE EXEC) fixed (fwd) Jim Knoble (Jun 29)
- Re: [RHSA-2000:039-02] remote root exploit (SITE EXEC) fixed (fwd) Andrea Costantino (Jun 29)
- Re: [RHSA-2000:039-02] remote root exploit (SITE EXEC) fixed (fwd) Kenn Humborg (Jun 29)
- Re: [RHSA-2000:039-02] remote root exploit (SITE EXEC) fixed (fwd) Philip Rowlands (Jun 29)
- Re: [RHSA-2000:039-02] remote root exploit (SITE EXEC) fixed (fwd) Helmethead (Jun 29)
- Re: [RHSA-2000:039-02] remote root exploit (SITE EXEC) fixed (fwd) Hugo.van.der.Kooij () CAIW NL (Jun 29)
- CONECTIVA LINUX SECURITY ANNOUNCEMENT - WU-FTPD Security (Jun 23)
- Security Update: wu-ftpd vulnerability Technical Support (Jun 23)
- Bruce 1.0 EA3: Networked Host-Vulnerability Scanner for Solaris & Linux Keith A. Watson (Jun 21)
- NetBSD Security Advisory 2000-007 security-officer () NETBSD ORG (Jun 21)
- Re: NAI WebShield SMTP does not scan base64 encoding Elias Levy (Jun 22)