Wzdftpd SITE Command Arbitrary Command Execution Vulnerability
BID:14935
Info
Wzdftpd SITE Command Arbitrary Command Execution Vulnerability
| Bugtraq ID: | 14935 |
| Class: | Input Validation Error |
| CVE: |
CVE-2005-3081 |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 24 2005 12:00AM |
| Updated: | Dec 15 2006 08:23PM |
| Credit: | Discovery is credited to kcope. |
| Vulnerable: |
wzdftpd wzdftpd 0.5.4 wzdftpd wzdftpd 0.5.2 Debian Linux 3.1 sparc Debian Linux 3.1 s/390 Debian Linux 3.1 ppc Debian Linux 3.1 mipsel Debian Linux 3.1 mips Debian Linux 3.1 m68k Debian Linux 3.1 ia-64 Debian Linux 3.1 ia-32 Debian Linux 3.1 hppa Debian Linux 3.1 arm Debian Linux 3.1 amd64 Debian Linux 3.1 alpha Debian Linux 3.1 |
| Not Vulnerable: | |
Discussion
Wzdftpd SITE Command Arbitrary Command Execution Vulnerability
The 'wzdftpd' utility is affected by a remote arbitrary command-execution vulnerability.
This issue can allow an attacker to execute commands in the context of an affected server and potentially gain unauthorized access.
Version 0.5.4 of wzdftpd is reported to be vulnerable. Other versions may be affected as well.
The 'wzdftpd' utility is affected by a remote arbitrary command-execution vulnerability.
This issue can allow an attacker to execute commands in the context of an affected server and potentially gain unauthorized access.
Version 0.5.4 of wzdftpd is reported to be vulnerable. Other versions may be affected as well.
Exploit / POC
Wzdftpd SITE Command Arbitrary Command Execution Vulnerability
An exploit is not required.
A proof of concept (wzdftpd_site.pm) Metasploit Framework exploit has been released.
An exploit is not required.
A proof of concept (wzdftpd_site.pm) Metasploit Framework exploit has been released.
Solution / Fix
Wzdftpd SITE Command Arbitrary Command Execution Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]:[email protected]
Please see references for more information and advisories.
wzdftpd wzdftpd 0.5.2
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]:[email protected]
Please see references for more information and advisories.
wzdftpd wzdftpd 0.5.2
-
Debian wzdftpd-back-mysql_0.5.2-1.1sarge1_alpha.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/w/wzdftpd/wzdftpd-back-my sql_0.5.2-1.1sarge1_alpha.deb -
Debian wzdftpd-back-mysql_0.5.2-1.1sarge1_amd64.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/w/wzdftpd/wzdftpd-back-my sql_0.5.2-1.1sarge1_amd64.deb -
Debian wzdftpd-back-mysql_0.5.2-1.1sarge1_arm.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/w/wzdftpd/wzdftpd-back-my sql_0.5.2-1.1sarge1_arm.deb -
Debian wzdftpd-back-mysql_0.5.2-1.1sarge1_hppa.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/w/wzdftpd/wzdftpd-back-my sql_0.5.2-1.1sarge1_hppa.deb -
Debian wzdftpd-back-mysql_0.5.2-1.1sarge1_i386.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/w/wzdftpd/wzdftpd-back-my sql_0.5.2-1.1sarge1_i386.deb -
Debian wzdftpd-back-mysql_0.5.2-1.1sarge1_ia64.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/w/wzdftpd/wzdftpd-back-my sql_0.5.2-1.1sarge1_ia64.deb -
Debian wzdftpd-back-mysql_0.5.2-1.1sarge1_m68k.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/w/wzdftpd/wzdftpd-back-my sql_0.5.2-1.1sarge1_m68k.deb -
Debian wzdftpd-back-mysql_0.5.2-1.1sarge1_mips.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/w/wzdftpd/wzdftpd-back-my sql_0.5.2-1.1sarge1_mips.deb -
Debian wzdftpd-back-mysql_0.5.2-1.1sarge1_mipsel.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/w/wzdftpd/wzdftpd-back-my sql_0.5.2-1.1sarge1_mipsel.deb -
Debian wzdftpd-back-mysql_0.5.2-1.1sarge1_powerpc.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/w/wzdftpd/wzdftpd-back-my sql_0.5.2-1.1sarge1_powerpc.deb -
Debian wzdftpd-back-mysql_0.5.2-1.1sarge1_s390.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/w/wzdftpd/wzdftpd-back-my sql_0.5.2-1.1sarge1_s390.deb -
Debian wzdftpd-back-mysql_0.5.2-1.1sarge1_sparc.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/w/wzdftpd/wzdftpd-back-my sql_0.5.2-1.1sarge1_sparc.deb -
Debian wzdftpd-dev_0.5.2-1.1sarge1_alpha.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/w/wzdftpd/wzdftpd-dev_0.5 .2-1.1sarge1_alpha.deb -
Debian wzdftpd-dev_0.5.2-1.1sarge1_amd64.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/w/wzdftpd/wzdftpd-dev_0.5 .2-1.1sarge1_amd64.deb -
Debian wzdftpd-dev_0.5.2-1.1sarge1_arm.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/w/wzdftpd/wzdftpd-dev_0.5 .2-1.1sarge1_arm.deb -
Debian wzdftpd-dev_0.5.2-1.1sarge1_hppa.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/w/wzdftpd/wzdftpd-dev_0.5 .2-1.1sarge1_hppa.deb -
Debian wzdftpd-dev_0.5.2-1.1sarge1_i386.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/w/wzdftpd/wzdftpd-dev_0.5 .2-1.1sarge1_i386.deb -
Debian wzdftpd-dev_0.5.2-1.1sarge1_ia64.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/w/wzdftpd/wzdftpd-dev_0.5 .2-1.1sarge1_ia64.deb -
Debian wzdftpd-dev_0.5.2-1.1sarge1_m68k.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/w/wzdftpd/wzdftpd-dev_0.5 .2-1.1sarge1_m68k.deb -
Debian wzdftpd-dev_0.5.2-1.1sarge1_mips.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/w/wzdftpd/wzdftpd-dev_0.5 .2-1.1sarge1_mips.deb -
Debian wzdftpd-dev_0.5.2-1.1sarge1_mipsel.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/w/wzdftpd/wzdftpd-dev_0.5 .2-1.1sarge1_mipsel.deb -
Debian wzdftpd-dev_0.5.2-1.1sarge1_powerpc.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/w/wzdftpd/wzdftpd-dev_0.5 .2-1.1sarge1_powerpc.deb -
Debian wzdftpd-dev_0.5.2-1.1sarge1_s390.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/w/wzdftpd/wzdftpd-dev_0.5 .2-1.1sarge1_s390.deb -
Debian wzdftpd-dev_0.5.2-1.1sarge1_sparc.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/w/wzdftpd/wzdftpd-dev_0.5 .2-1.1sarge1_sparc.deb -
Debian wzdftpd-mod-perl_0.5.2-1.1sarge1_alpha.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/w/wzdftpd/wzdftpd-mod-per l_0.5.2-1.1sarge1_alpha.deb -
Debian wzdftpd-mod-perl_0.5.2-1.1sarge1_amd64.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/w/wzdftpd/wzdftpd-mod-per l_0.5.2-1.1sarge1_amd64.deb -
Debian wzdftpd-mod-perl_0.5.2-1.1sarge1_arm.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/w/wzdftpd/wzdftpd-mod-per l_0.5.2-1.1sarge1_arm.deb -
Debian wzdftpd-mod-perl_0.5.2-1.1sarge1_hppa.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/w/wzdftpd/wzdftpd-mod-per l_0.5.2-1.1sarge1_hppa.deb -
Debian wzdftpd-mod-perl_0.5.2-1.1sarge1_i386.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/w/wzdftpd/wzdftpd-mod-per l_0.5.2-1.1sarge1_i386.deb -
Debian wzdftpd-mod-perl_0.5.2-1.1sarge1_ia64.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/w/wzdftpd/wzdftpd-mod-per l_0.5.2-1.1sarge1_ia64.deb -
Debian wzdftpd-mod-perl_0.5.2-1.1sarge1_m68k.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/w/wzdftpd/wzdftpd-mod-per l_0.5.2-1.1sarge1_m68k.deb -
Debian wzdftpd-mod-perl_0.5.2-1.1sarge1_mips.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/w/wzdftpd/wzdftpd-mod-per l_0.5.2-1.1sarge1_mips.deb -
Debian wzdftpd-mod-perl_0.5.2-1.1sarge1_mipsel.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/w/wzdftpd/wzdftpd-mod-per l_0.5.2-1.1sarge1_mipsel.deb -
Debian wzdftpd-mod-perl_0.5.2-1.1sarge1_powerpc.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/w/wzdftpd/wzdftpd-mod-per l_0.5.2-1.1sarge1_powerpc.deb -
Debian wzdftpd-mod-perl_0.5.2-1.1sarge1_s390.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/w/wzdftpd/wzdftpd-mod-per l_0.5.2-1.1sarge1_s390.deb -
Debian wzdftpd-mod-perl_0.5.2-1.1sarge1_sparc.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/w/wzdftpd/wzdftpd-mod-per l_0.5.2-1.1sarge1_sparc.deb -
Debian wzdftpd-mod-tcl_0.5.2-1.1sarge1_alpha.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/w/wzdftpd/wzdftpd-mod-tcl _0.5.2-1.1sarge1_alpha.deb -
Debian wzdftpd-mod-tcl_0.5.2-1.1sarge1_amd64.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/w/wzdftpd/wzdftpd-mod-tcl _0.5.2-1.1sarge1_amd64.deb -
Debian wzdftpd-mod-tcl_0.5.2-1.1sarge1_arm.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/w/wzdftpd/wzdftpd-mod-tcl _0.5.2-1.1sarge1_arm.deb -
Debian wzdftpd-mod-tcl_0.5.2-1.1sarge1_hppa.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/w/wzdftpd/wzdftpd-mod-tcl _0.5.2-1.1sarge1_hppa.deb -
Debian wzdftpd-mod-tcl_0.5.2-1.1sarge1_i386.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/w/wzdftpd/wzdftpd-mod-tcl _0.5.2-1.1sarge1_i386.deb -
Debian wzdftpd-mod-tcl_0.5.2-1.1sarge1_ia64.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/w/wzdftpd/wzdftpd-mod-tcl _0.5.2-1.1sarge1_ia64.deb -
Debian wzdftpd-mod-tcl_0.5.2-1.1sarge1_m68k.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/w/wzdftpd/wzdftpd-mod-tcl _0.5.2-1.1sarge1_m68k.deb -
Debian wzdftpd-mod-tcl_0.5.2-1.1sarge1_mips.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/w/wzdftpd/wzdftpd-mod-tcl _0.5.2-1.1sarge1_mips.deb -
Debian wzdftpd-mod-tcl_0.5.2-1.1sarge1_mipsel.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/w/wzdftpd/wzdftpd-mod-tcl _0.5.2-1.1sarge1_mipsel.deb -
Debian wzdftpd-mod-tcl_0.5.2-1.1sarge1_powerpc.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/w/wzdftpd/wzdftpd-mod-tcl _0.5.2-1.1sarge1_powerpc.deb -
Debian wzdftpd-mod-tcl_0.5.2-1.1sarge1_s390.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/w/wzdftpd/wzdftpd-mod-tcl _0.5.2-1.1sarge1_s390.deb -
Debian wzdftpd-mod-tcl_0.5.2-1.1sarge1_sparc.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/w/wzdftpd/wzdftpd-mod-tcl _0.5.2-1.1sarge1_sparc.deb -
Debian wzdftpd_0.5.2-1.1sarge1_alpha.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/w/wzdftpd/wzdftpd_0.5.2-1 .1sarge1_alpha.deb -
Debian wzdftpd_0.5.2-1.1sarge1_amd64.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/w/wzdftpd/wzdftpd_0.5.2-1 .1sarge1_amd64.deb -
Debian wzdftpd_0.5.2-1.1sarge1_arm.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/w/wzdftpd/wzdftpd_0.5.2-1 .1sarge1_arm.deb -
Debian wzdftpd_0.5.2-1.1sarge1_hppa.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/w/wzdftpd/wzdftpd_0.5.2-1 .1sarge1_hppa.deb -
Debian wzdftpd_0.5.2-1.1sarge1_i386.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/w/wzdftpd/wzdftpd_0.5.2-1 .1sarge1_i386.deb -
Debian wzdftpd_0.5.2-1.1sarge1_ia64.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/w/wzdftpd/wzdftpd_0.5.2-1 .1sarge1_ia64.deb -
Debian wzdftpd_0.5.2-1.1sarge1_m68k.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/w/wzdftpd/wzdftpd_0.5.2-1 .1sarge1_m68k.deb -
Debian wzdftpd_0.5.2-1.1sarge1_mips.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/w/wzdftpd/wzdftpd_0.5.2-1 .1sarge1_mips.deb -
Debian wzdftpd_0.5.2-1.1sarge1_mipsel.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/w/wzdftpd/wzdftpd_0.5.2-1 .1sarge1_mipsel.deb -
Debian wzdftpd_0.5.2-1.1sarge1_powerpc.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/w/wzdftpd/wzdftpd_0.5.2-1 .1sarge1_powerpc.deb -
Debian wzdftpd_0.5.2-1.1sarge1_s390.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/w/wzdftpd/wzdftpd_0.5.2-1 .1sarge1_s390.deb -
Debian wzdftpd_0.5.2-1.1sarge1_sparc.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/w/wzdftpd/wzdftpd_0.5.2-1 .1sarge1_sparc.deb
References
Wzdftpd SITE Command Arbitrary Command Execution Vulnerability
References:
References:
- wzdftpd Homepage (wzdftpd)