Washington University wu-ftpd 2.6.2
+
Compaq Tru64 5.1 b PK2 (BL22)
+
Compaq Tru64 5.1 b PK1 (BL1)
+
Compaq Tru64 5.1 b
+
Compaq Tru64 5.1 a PK5 (BL23)
+
Compaq Tru64 5.1 a PK4 (BL21)
+
Compaq Tru64 5.1 a PK3 (BL3)
+
Compaq Tru64 5.1 a PK2 (BL2)
+
Compaq Tru64 5.1 a PK1 (BL1)
+
Compaq Tru64 5.1 a
+
Compaq Tru64 5.1 PK6 (BL20)
+
Compaq Tru64 5.1 PK5 (BL19)
+
Compaq Tru64 5.1 PK4 (BL18)
+
Compaq Tru64 5.1 PK3 (BL17)
+
Compaq Tru64 5.1
+
Compaq Tru64 5.0 f
+
Compaq Tru64 5.0 a PK3 (BL17)
+
Compaq Tru64 5.0 a
+
Compaq Tru64 5.0 PK4 (BL18)
+
Compaq Tru64 5.0 PK4 (BL17)
+
Compaq Tru64 5.0
+
Compaq Tru64 4.0 g PK3 (BL17)
+
Compaq Tru64 4.0 g
+
Compaq Tru64 4.0 f PK7 (BL18)
+
Compaq Tru64 4.0 f PK6 (BL17)
+
Compaq Tru64 4.0 f
+
Compaq Tru64 4.0 e
+
Compaq Tru64 4.0 d PK9 (BL17)
+
Compaq Tru64 4.0 d
+
Compaq Tru64 4.0 b
+
Debian Linux 3.0 sparc
+
Debian Linux 3.0 s/390
+
Debian Linux 3.0 ppc
+
Debian Linux 3.0 mipsel
+
Debian Linux 3.0 mips
+
Debian Linux 3.0 m68k
+
Debian Linux 3.0 ia-64
+
Debian Linux 3.0 ia-32
+
Debian Linux 3.0 hppa
+
Debian Linux 3.0 arm
+
Debian Linux 3.0 alpha
+
Debian Linux 3.0
+
Mandriva Linux Mandrake 8.2 ppc
+
Mandriva Linux Mandrake 8.2
+
SCO Open Server 5.0.7
+
SCO Open Server 5.0.6 a
+
SCO Open Server 5.0.6
+
Sun Linux 5.0.7
+
Turbolinux Turbolinux Advanced Server 6.0
+
Turbolinux Turbolinux Server 6.1
+
Turbolinux Turbolinux Workstation 6.0
Washington University wu-ftpd 2.6.1
+
Caldera OpenLinux 2.3
+
Caldera OpenLinux Server 3.1
+
Cobalt Qube 1.0
-
FreeBSD FreeBSD 5.0 alpha
-
FreeBSD FreeBSD 5.0
-
FreeBSD FreeBSD 4.4
-
FreeBSD FreeBSD 4.3 -STABLE
-
FreeBSD FreeBSD 4.3 -RELEASE
-
FreeBSD FreeBSD 4.3
+
MandrakeSoft Corporate Server 1.0.1
+
Mandriva Linux Mandrake 8.1
+
Mandriva Linux Mandrake 8.0 ppc
+
Mandriva Linux Mandrake 8.0
+
Mandriva Linux Mandrake 7.2
+
Mandriva Linux Mandrake 7.1
+
Mandriva Linux Mandrake 7.0
+
Mandriva Linux Mandrake 6.1
+
Mandriva Linux Mandrake 6.0
+
Redhat Linux 7.2 noarch
+
Redhat Linux 7.2 ia64
+
Redhat Linux 7.2 i686
+
Redhat Linux 7.2 i586
+
Redhat Linux 7.2 i386
+
Redhat Linux 7.2 athlon
+
Redhat Linux 7.2 alpha
+
Redhat Linux 7.1 noarch
+
Redhat Linux 7.1 ia64
+
Redhat Linux 7.1 i686
+
Redhat Linux 7.1 i586
+
Redhat Linux 7.1 i386
+
Redhat Linux 7.1 alpha
+
Redhat Linux 7.0 sparc
+
Redhat Linux 7.0 i386
+
Redhat Linux 7.0 alpha
+
SCO eDesktop 2.4
+
SCO eServer 2.3.1
+
SCO Open Server 5.0.6 a
+
SCO Open Server 5.0.6
+
SCO Open Server 5.0.5
+
SCO Open Server 5.0.4
+
SCO Open Server 5.0.3
+
SCO Open Server 5.0.2
+
SCO Open Server 5.0.1
+
SCO Open Server 5.0
-
Slackware Linux 8.0
-
Slackware Linux 7.1
-
Slackware Linux 7.0
-
SuSE Linux 7.3
-
SuSE Linux 7.2
-
SuSE Linux 7.1 x86
-
SuSE Linux 7.1 sparc
-
SuSE Linux 7.1 ppc
-
SuSE Linux 7.1 alpha
-
SuSE Linux 7.1
-
SuSE Linux 7.0 sparc
-
SuSE Linux 7.0 ppc
-
SuSE Linux 7.0 alpha
-
SuSE Linux 7.0
+
Turbolinux Turbolinux 6.0.5
+
Turbolinux Turbolinux 6.0.4
+
Turbolinux Turbolinux 6.0.3
+
Turbolinux Turbolinux 6.0.2
+
Turbolinux Turbolinux 6.0.1
+
Turbolinux Turbolinux 6.0
+
Turbolinux Turbolinux Workstation 6.1
+
Wirex Immunix OS 7.0 -Beta
+
Wirex Immunix OS 7.0
+
Wirex Immunix OS 7+
Washington University wu-ftpd 2.6 .0
+
Cobalt Qube 1.0
+
Debian Linux 2.2 sparc
+
Debian Linux 2.2 powerpc
+
Debian Linux 2.2 arm
+
Debian Linux 2.2 alpha
+
Debian Linux 2.2 68k
+
Debian Linux 2.2
-
FreeBSD FreeBSD 4.4
-
FreeBSD FreeBSD 4.3 -STABLE
-
FreeBSD FreeBSD 4.3 -RELEASE
-
FreeBSD FreeBSD 4.3
+
HP HP-UX 11.11
+
HP HP-UX 11.0
+
Redhat Linux 6.2 sparc
+
Redhat Linux 6.2 i386
+
Redhat Linux 6.2 alpha
+
Redhat Linux 6.1 sparc
+
Redhat Linux 6.1 i386
+
Redhat Linux 6.1 alpha
+
Redhat Linux 6.0 sparc
+
Redhat Linux 6.0 alpha
+
Redhat Linux 6.0
+
Redhat Linux 5.2 sparc
+
Redhat Linux 5.2 i386
+
Redhat Linux 5.2 alpha
+
SuSE Linux 7.3 sparc
+
SuSE Linux 7.3 ppc
+
SuSE Linux 7.3 i386
+
SuSE Linux 7.2 i386
+
SuSE Linux 7.1 x86
+
SuSE Linux 7.1 sparc
+
SuSE Linux 7.1 ppc
+
SuSE Linux 7.1 alpha
+
SuSE Linux 7.0 sparc
+
SuSE Linux 7.0 ppc
+
SuSE Linux 7.0 i386
+
SuSE Linux 7.0 alpha
+
SuSE Linux 6.4 ppc
+
SuSE Linux 6.4 alpha
+
SuSE Linux 6.4
+
SuSE Linux 6.3 ppc
+
SuSE Linux 6.3 alpha
+
SuSE Linux 6.3
+
SuSE Linux 6.2
+
SuSE Linux 6.1 alpha
+
SuSE Linux 6.1
+
Turbolinux Turbolinux 4.0
+
Wirex Immunix OS 6.2
Washington University wu-ftpd 2.5 .0
+
Caldera OpenLinux 2.4
+
Caldera OpenLinux Desktop 2.3
+
Redhat Linux 6.0 sparc
+
Redhat Linux 6.0 alpha
+
Redhat Linux 6.0
+
SCO eDesktop 2.4
+
SCO eServer 2.3.1
+
SCO eServer 2.3
Washington University wu-ftpd 2.4.2 (beta 18) VR4
anonFTP anonFTP 3.0
Not Vulnerable:
Discussion
Multiple Vendor FTP Conversion Vulnerability
Some FTP servers provide a "conversion" service that pipes a requested file through a program, for example a decompression utility such as "tar", before it is passed to the remote user. Under some configurations where this is enabled a remote user can pass a filename beginning with a minus sign to FTP, which will pass this as an argument to the compression/archiver program (where it will be erroneously treated as a command line argument other than a filename). It may be possible to exploit this and execute commands on a remote machine. An example of this exploits the "--use-compress-program PROG" parameter passed to tar; if PROG refers to a program that is accessible to the FTP server, it will be executed. The remote user must have access to a writeable directory in order to exploit this. See exploit for details.