topic Re: WU-FTPD fb_realpath() Off-By-One Buffer Overflow in Operating System - HP-UX

WU-FTPD fb_realpath() Off-By-One Buffer Overflow

Chrisl_2 — Fri, 13 Apr 2007 11:26:13 GMT

HP-UX 11iv2 PARISC

Hi all. I am running wu-ftpd 2.6.1. I have 2 questions on security of this program.

1. My security-patch check tool doesn't alert me to the vulnerability. I download a new catalog every nite, so I am wondering why.

2. If I am understanding the CERT correctly, it seems that I have to install 2.6.2 from HP, then run the wu realpath patch from wu. Has anyone done this, if so, how did it work out?

TIA!

Re: WU-FTPD fb_realpath() Off-By-One Buffer Overflow

Chrisl_2 — Mon, 16 Apr 2007 13:01:44 GMT

Anybody? If not, I'll close the thread.

TIA

Re: WU-FTPD fb_realpath() Off-By-One Buffer Overflow

Steven Schweda — Mon, 16 Apr 2007 16:08:58 GMT

I know nothing, but it appears that if I
wanted to learn anything about "the
vulnerability", I'd need to do all my own
research, because you've provided no
references where I might discover about what
you're talking. "[T]he CERT" is a long way
from a link to a description of "the
vulnerability".

And while _I_ may know nothing, I may not be
the only one who's too lazy to go through all
that duplicative effort.

Re: WU-FTPD fb_realpath() Off-By-One Buffer Overflow

Jason Haase — Tue, 15 May 2007 12:37:34 GMT

Hi,

I am also inquiring about this, I use a tool called found stone and it sees this WU-FTPD Off-by-one Buffer overflow vulnerability.

It looks like version 11.0 and 11.1 of HU-UX there is a patch for WU-FTP.

I am running 11.23 on Sparc, any body know where I can get a depot for the latest patch for this?