Debian Linux fsp Package Vulnerability
BID:316
Info
Debian Linux fsp Package Vulnerability
| Bugtraq ID: | 316 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | Yes |
| Published: | Feb 17 1999 12:00AM |
| Updated: | Feb 17 1999 12:00AM |
| Credit: | First posted to bugtraq by Jamie Fifield <[email protected]> on Feb 17, 1999. |
| Vulnerable: |
Debian Linux 2.0 |
| Not Vulnerable: |
Debian Linux 2.0 r5 |
Discussion
Debian Linux fsp Package Vulnerability
fsp is an alternative to ftp that comes with Debian Linux. In the pre-2.0r5 releases of the Debian Linux distribution, when the fsp package is installed it adds the ftp user to the passwd file without prompting or notifying the user/admin. With some ftp daemons, this is all that is needed to allow for anonymous ftp.
fsp is an alternative to ftp that comes with Debian Linux. In the pre-2.0r5 releases of the Debian Linux distribution, when the fsp package is installed it adds the ftp user to the passwd file without prompting or notifying the user/admin. With some ftp daemons, this is all that is needed to allow for anonymous ftp.
Exploit / POC
Debian Linux fsp Package Vulnerability
The fsp package by itself is not exploitable, however, when it's installed it could unknowingly allow for other packages to be exploited. An example of this is wu-ftpd exploitable via realpath through anonymous ftp.
The fsp package by itself is not exploitable, however, when it's installed it could unknowingly allow for other packages to be exploited. An example of this is wu-ftpd exploitable via realpath through anonymous ftp.
Solution / Fix
Debian Linux fsp Package Vulnerability
Solution:
The problem was one of several fixed in the Debian 2.0r5 release.
Solution:
The problem was one of several fixed in the Debian 2.0r5 release.