Multiple Vendor FTP Long Path Buffer Overflow Vulnerability

Bugtraq ID:	2242
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	Yes
Published:	Feb 09 1999 12:00AM
Updated:	Feb 09 1999 12:00AM
Credit:	This vulnerability was revelead in a security bulletin on February 9, 1999 by Netect.
Vulnerable:	Washington University wu-ftpd 2.4.2 academ[BETA-18] + Redhat Linux 5.2 i386 Washington University wu-ftpd 2.4.2 (beta 18) VR9 ProFTPD Project ProFTPD 1.2 pre1 ProFTPD Project ProFTPD 1.2 + Cobalt Qube 3.0 + Cobalt Qube 2.0 + Cobalt RaQ 3.0 + Cobalt RaQ 2.0 + Cobalt RaQ 1.1
Not Vulnerable:	Washington University wu-ftpd 2.4.2 (beta 18) VR13 Washington University wu-ftpd 2.4.2 (beta 18) VR12 Washington University wu-ftpd 2.4.2 (beta 18) VR11 Washington University wu-ftpd 2.4.2 (beta 18) VR10 ProFTPD Project ProFTPD 1.2 pre2

Multiple Vendor FTP Long Path Buffer Overflow Vulnerability

Currently the SecurityFocus staff are not aware of any publicly available exploits for this vulnerability. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

Multiple Vendor FTP Long Path Buffer Overflow Vulnerability

Solution:
The fix for wuftp was incorporated into 2.4.2 beta 18 VR10, released November 1, 1998. Upgrade to this version or later. proftp resolved this issue with version 1.2.0pre2; a patch is also available for 1.2.0pre1.

Multiple Vendor FTP Long Path Buffer Overflow Vulnerability

References: