Re: [RHSA-2000:039-02] remote root exploit (SITE EXEC) fixed (fwd)

[jmknoble () PINT-STOWP CX (Jim Knoble)]

Circa 2000-Jun-29 10:23:12 +0000 schrieb Joey Maier:

: >RHSA-2000:039-02: remote root exploit (SITE EXEC) fixed
: [...]
: >
: >Red Hat Linux 5.2 - i386 alpha sparc
:
:       (which includes wu-ftpd-2.4.2b18-2.i386.rpm)

Actually, if you've been keeping up with security updates, a Red Hat
5.2 system should have had wu-ftpd-2.6.0-0.5.x installed prior
to this update.

: >Red Hat Linux 6.2 - i386 alpha sparc
:
:       (which includes wu-ftpd-2.6.0-3.i386.rpm)
:
: What about Red Hat 6.0 (includes wu-ftpd-2.4.2vr17-3.i386.rpm) and
: 6.1 (includes wu-ftpd-2.5.0-9.i386.rpm)? I know that the sploit tf8
: released was for version 2.6.0, but earlier versions of wu-ftpd
: are vunerable, too.  Does anyone know if Red Hat plans to release
: RPMs to fix the 2.5.0 version included in Red Hat 6.1?

The text of the security advisory doesn't appear to mention it, but the
6.2 packages are also intended for 6.0 and 6.1.  This has generally
been true of security and bugfix updates from Red Hat since 6.2 was
released.

What i'm a little surprised you didn't ask about was whether Red Hat
plans to release wu-ftpd security updates for Red Hat Linux 4.2, which
quite a few folks are still running in some capacity or another.

--
jim knoble | jmknoble () jmknoble cx | http://www.jmknoble.cx/