Wu-ftpd SITE NEWER Denial of Service Vulnerability

Bugtraq ID:	737
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	Oct 21 1999 12:00AM
Updated:	Oct 21 1999 12:00AM
Credit:	Released in CERT advisory CA-99-13, posted to BugTraq on Oct 19, 1999 and originally AUSCERT advisory AA-99.02, published on Oct 19, 1999.
Vulnerable:	Washington University wu-ftpd 2.5 .0 + Caldera OpenLinux 2.4 + Caldera OpenLinux Desktop 2.3 + Redhat Linux 6.0 sparc + Redhat Linux 6.0 alpha + Redhat Linux 6.0 + SCO eDesktop 2.4 + SCO eServer 2.3.1 + SCO eServer 2.3
Not Vulnerable:	Washington University wu-ftpd 2.6 .0 + Cobalt Qube 1.0 + Debian Linux 2.2 sparc + Debian Linux 2.2 powerpc + Debian Linux 2.2 arm + Debian Linux 2.2 alpha + Debian Linux 2.2 68k + Debian Linux 2.2 - FreeBSD FreeBSD 4.4 - FreeBSD FreeBSD 4.3 -STABLE - FreeBSD FreeBSD 4.3 -RELEASE - FreeBSD FreeBSD 4.3 + HP HP-UX 11.11 + HP HP-UX 11.0 + Redhat Linux 6.2 sparc + Redhat Linux 6.2 i386 + Redhat Linux 6.2 alpha + Redhat Linux 6.1 sparc + Redhat Linux 6.1 i386 + Redhat Linux 6.1 alpha + Redhat Linux 6.0 sparc + Redhat Linux 6.0 alpha + Redhat Linux 6.0 + Redhat Linux 5.2 sparc + Redhat Linux 5.2 i386 + Redhat Linux 5.2 alpha + SuSE Linux 7.3 sparc + SuSE Linux 7.3 ppc + SuSE Linux 7.3 i386 + SuSE Linux 7.2 i386 + SuSE Linux 7.1 x86 + SuSE Linux 7.1 sparc + SuSE Linux 7.1 ppc + SuSE Linux 7.1 alpha + SuSE Linux 7.0 sparc + SuSE Linux 7.0 ppc + SuSE Linux 7.0 i386 + SuSE Linux 7.0 alpha + SuSE Linux 6.4 ppc + SuSE Linux 6.4 alpha + SuSE Linux 6.4 + SuSE Linux 6.3 ppc + SuSE Linux 6.3 alpha + SuSE Linux 6.3 + SuSE Linux 6.2 + SuSE Linux 6.1 alpha + SuSE Linux 6.1 + Turbolinux Turbolinux 4.0 + Wirex Immunix OS 6.2

Wu-ftpd SITE NEWER Denial of Service Vulnerability

It may be possible for remote users to cause wu-ftpd to consume large amounts of memory, creating a denial of service. If users can upload files, arbitrary code can be executed with the uid of the ftpd (usually root).

Wu-ftpd SITE NEWER Denial of Service Vulnerability

Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

Wu-ftpd SITE NEWER Denial of Service Vulnerability

Solution:
You can upgrade to the newest version of Wu-ftpd (2.6) for any vulnerable platform.

RedHat has released patches available at the following locations:

Red Hat Linux 4.2
- -----------------

Intel:
ftp://updates.redhat.com//4.2/i386/wu-ftpd-2.6.0-0.4.2.i386.rpm
Alpha:
ftp://updates.redhat.com//4.2/alpha/wu-ftpd-2.6.0-0.4.2.alpha.rpm
Sparc:
ftp://updates.redhat.com//4.2/sparc/wu-ftpd-2.6.0-0.4.2.sparc.rpm
Source packages:
ftp://updates.redhat.com//4.2/SRPMS/wu-ftpd-2.6.0-0.4.2.src.rpm

Red Hat Linux 5.2
- -----------------

Intel:
ftp://updates.redhat.com//5.2/i386/wu-ftpd-2.6.0-0.5.x.i386.rpm
Alpha:
ftp://updates.redhat.com//5.2/alpha/wu-ftpd-2.6.0-0.5.x.alpha.rpm
Sparc:
ftp://updates.redhat.com//5.2/sparc/wu-ftpd-2.6.0-0.5.x.sparc.rpm
Source packages:
ftp://updates.redhat.com//5.2/SRPMS/wu-ftpd-2.6.0-0.5.x.src.rpm

Red Hat Linux 6.x
- -----------------

Intel:
ftp://updates.redhat.com//6.0/i386/wu-ftpd-2.6.0-1.i386.rpm
Alpha:
ftp://updates.redhat.com//6.0/alpha/wu-ftpd-2.6.0-1.alpha.rpm
Sparc:
ftp://updates.redhat.com//6.0/sparc/wu-ftpd-2.6.0-1.sparc.rpm
Source packages:
ftp://updates.redhat.com//6.0/SRPMS/wu-ftpd-2.6.0-1.src.rpm

Wu-ftpd SITE NEWER Denial of Service Vulnerability

References:

• Updates, Fixes, and Errata Page (RedHat)