Red Hat, Inc. Security Advisory
Package wu-ftpd
Synopsis Security problems in WU- FTPD
Advisory ID RHSA-1999:043-01
Issue Date 1999-10-21
Updated on
Keywords wu-ftp security remote exploit
Cross references N/A


1. Topic:
Various computer security groups have reported security problems in the WU-FTPD daemon, the FTP server shipped with all versions of Red Hat Linux.

2. Problem description:
Three vulnerabilities have been identified in WU-FTPD and other ftp daemons based on the WU-FTPD source code.

Vulnerability #1: MAPPING_CHDIR Buffer Overflow
Vulnerability #2: Message File Buffer Overflow

Remote and local intruders may be able exploit these vulnerabilities to execute arbitrary code as the user running the ftpd daemon, usually root.

Vulnerability #3: SITE NEWER Consumes Memory

Remote and local intruders who can connect to the FTP server can cause the server to consume excessive amounts of memory, preventing normal system operation. If intruders can create files on the system, they may be able exploit this vulnerability to execute arbitrary code as the user running the ftpd daemon, usually root.

3. Bug IDs fixed:(https://bugzilla.redhat.com for more info)
N/A

4. Relevant releases/architectures:
Red Hat Linux 6.1, for i386, alpha and sparc

5. Obsoleted by:
None

6. Conflicts with:
None

7. RPMs required:

Intel:

wu-ftpd- 2.6.0-1.i386.rpm

Alpha:

wu-ftpd- 2.6.0-1.alpha.rpm

SPARC:

wu-ftpd- 2.6.0-1.sparc.rpm

Source:

wu-ftpd- 2.6.0-1.src.rpm

Architecture neutral:

8. Solution:
For each RPM for your particular architecture, run:

rpm -Uvh filename

where filename is the name of the RPM.

9. Verification:


 MD5 sum                           Package Name

 -------------------------------------------------------------------------
dcd5d04df11849007aa3c4fb398cfbfb  i386/wu-ftpd-2.6.0-1.i386.rpm
a0b3a1a0dcfbdfd1443d0aecd960e907  alpha/wu-ftpd-2.6.0-1.alpha.rpm
7511f1f96b3044207cbe11d34f75ff7a  sparc/wu-ftpd-2.6.0-1.sparc.rpm
7e30ea42e82908752b943621580f6f1c  SRPMS/wu-ftpd-2.6.0-1.src.rpm
These packages are GPG signed by Red Hat Inc. for security. Our key is available at:

You can verify each package with the following command:

rpm --checksig filename

If you only wish to verify that each package has not been corrupted or tampered with, examine only the md5sum with the following command:

rpm --checksig --nogpg filename

10. References:

RH6.1: wu-ftpd (RHSA-1999:043-01)

Various computer security groups have reported security problems in the WU-FTPD daemon, the FTP server shipped with all versions of Red Hat Linux

Summary



Summary

Three vulnerabilities have been identified in WU-FTPD and other ftp daemonsbased on the WU-FTPD source code.

Vulnerability #1: MAPPING_CHDIR Buffer Overflow
Vulnerability #2: Message File Buffer Overflow

Remote and local intruders may be able exploit these vulnerabilities to execute arbitrary code as the user running the ftpd daemon, usually root.

Vulnerability #3: SITE NEWER Consumes Memory

Remote and local intruders who can connect to the FTP server can cause the server to consume excessive amounts of memory, preventing normal system operation. If intruders can create files on the system, they may be able exploit this vulnerability to execute arbitrary code as the user running the ftpd daemon, usually root.

3. Bug IDs fixed:(https://bugzilla.redhat.com for more info)
N/A


Solution



For each RPM for your particular architecture, run:


rpm -Uvh filename


where filename is the name of the RPM.

9. Verification:


 MD5 sum                           Package Name

dcd5d04df11849007aa3c4fb398cfbfb  i386/wu-ftpd-2.6.0-1.i386.rpm
a0b3a1a0dcfbdfd1443d0aecd960e907  alpha/wu-ftpd-2.6.0-1.alpha.rpm
7511f1f96b3044207cbe11d34f75ff7a  sparc/wu-ftpd-2.6.0-1.sparc.rpm
7e30ea42e82908752b943621580f6f1c  SRPMS/wu-ftpd-2.6.0-1.src.rpm



These packages are GPG signed by Red Hat Inc. for security. Our key is available at:


You can verify each package with the following command:


rpm --checksig filename


If you only wish to verify that each package has not been corrupted or
tampered with, examine only the md5sum with the following command:


rpm --checksig --nogpg filename






References


Package List


Severity

Topic


Topic

Various computer security groups have reported security problems in the

WU-FTPD daemon, the FTP server shipped with all versions of Red Hat Linux.


 

Relevant Releases Architectures

Red Hat Linux 6.1, for i386, alpha and sparc

5. Obsoleted by:

None

6. Conflicts with:

None

7. RPMs required:

Intel:

wu-ftpd-

2.6.0-1.i386.rpm

Alpha:

wu-ftpd-

2.6.0-1.alpha.rpm

SPARC:

wu-ftpd-

2.6.0-1.sparc.rpm

Source:

wu-ftpd-

2.6.0-1.src.rpm

Architecture neutral:


Bugs Fixed


Related News

23.Tablet Connections Esm H320
2 - 3 min read
The release of Ubuntu 24.04 LTS , also known as Noble Numbat, brings various security enhancements and exciting new features . These improvements
4.Lock AbstractDigital Esm H320
2 - 3 min read
Tails 6.2 is a new Linux distribution release that expands its multilingual support and improves security features. The distribution is a
19.Laptop Bed Esm H320
2 - 3 min read
AlmaLinux 9.4 beta has been released and provides compelling reasons to consider it for desktop usage. While AlmaLinux is primarily known as a
32.Lock Code Circular Esm H320
2 - 3 min read
Linux admins and security practitioners face significant challenges in keeping their Linux systems secure amidst the constant threat of kernel bugs.
1.Penguin Landscape Esm H320
2 - 3 min read
A significant security threat, known as the Spectre v2 exploit, has been observed targeting Linux systems running on modern Intel processors. Let's
10.FingerPrint Locks Esm H320
2 - 3 min read
The recent release of I2P 2.5.0 , an anonymous P2P network that protects against online censorship, surveillance, and monitoring, has brought a slew
24.Key Code Esm H320
2 - 3 min read
The Akira ransomware group has extorted approximately $42 million from over 250 victims since January 1, 2024. The group initially focused on
5.ShakingHands Esm H320
2 - 3 min read
At The Linux Foundation's Open Source Summit North America , Linus Torvalds, the creator of Linux, discussed various topics related to Linux
Sign Up

Get the Latest News & Insights

Sign up to get the latest security news affecting Linux and open source delivered straight to your inbox.

© 2024 Guardian Digital, Inc All Rights Reserved