Re: [RHSA-2000:039-02] remote root exploit (SITE EXEC) fixed (fwd)

[costan () COMM2000 IT (Andrea Costantino)]

On Thu, 29 Jun 2000, Joey Maier wrote:

> > RHSA-2000:039-02: remote root exploit (SITE EXEC) fixed
> [...]
> > A security bug in wu-ftpd can permit remote users, even without
> > an account, to gain root access.
> > The new version closes the hole.
> >
> > 2. Relevant releases/architectures:
> >
> > Red Hat Linux 5.2 - i386 alpha sparc
>
>       (which includes wu-ftpd-2.4.2b18-2.i386.rpm)
>
> > Red Hat Linux 6.2 - i386 alpha sparc
>
>       (which includes wu-ftpd-2.6.0-3.i386.rpm)
>
> What about Red Hat 6.0 (includes wu-ftpd-2.4.2vr17-3.i386.rpm) and
> 6.1 (includes wu-ftpd-2.5.0-9.i386.rpm)? I know that the sploit tf8
> released was for version 2.6.0, but earlier versions of wu-ftpd
> are vunerable, too.  Does anyone know if Red Hat plans to release
> RPMs to fix the 2.5.0 version included in Red Hat 6.1?
If u go to
ftp://updates.redhat.com/pub/6.1
u'll find the same RPM for the 6.2 distribution.
That is:
wu-ftpd-2.6.0-14.6x.i386.rpm

The package works perfectly on my systems, even if I didn't checked the
SITE EXEC exploit on it. I suppose that the RH people doesn't lies :) .

Baciamo le mani,
k0

------------------------------------------------------------------------

                        PER IL RE!
                        NEL VOSTRO ONORE!

                                           (il pupetto di WarCraft II)
------------------------------------------------------------------------