topic Re: SSRT3603 wu-ftpd off by one vulnerability (rev.1) in Operating System - HP-UX

SSRT3603 wu-ftpd off by one vulnerability (rev.1)

Berlene Herren — Fri, 19 Sep 2003 10:27:42 GMT

A security bulletin has been issued:

-----------------------------------------------------------------
**REVISED 01**
Source: HEWLETT-PACKARD COMPANY
SECURITY BULLETIN: HPSBUX0309-277
Originally issued: 02 September 2003
Last revised: 15 September 2003
SSRT3603 wu-ftpd off by one vulnerability (rev.1)
-----------------------------------------------------------------

To access the bulletin from the itrc:

Select "maintenance and support"
Select "search technical knowledge base"
Select "HP-UX Software Security Bulletins"
Select "Search by Security Bulletin Number"
Enter " HPSBUX0309-277"
Search

===============================================================

Berlene

Re: SSRT3603 wu-ftpd off by one vulnerability (rev.1)

Gerald Miller_1 — Mon, 29 Sep 2003 08:54:06 GMT

Berlene,
The bulletin says that I can download the new WU-FTPD from http://software.hp.com.

However, when I search for WU-FTPD there, I can only find the older version (B.11.00.01.00), and not the new revision (B.11.00.01.003).

Is there anyway for us to get a direct link?
Thanks,
Gerald

Re: SSRT3603 wu-ftpd off by one vulnerability (rev.1)

Steven E. Protter — Mon, 29 Sep 2003 09:23:15 GMT

I've just downloaded the version indicated in the security bulliten for 11.00 and 11.11

http://software.hp.com/portal/swdepot/displayProductInfo.do?productNumber=WUFTPD26

SEP

Re: SSRT3603 wu-ftpd off by one vulnerability (rev.1)

Berlene Herren — Mon, 29 Sep 2003 09:25:46 GMT

Hi Gerald
I just downloaded it for 11.0 and installed...

root@cricket-/>swlist -l fileset | grep WUFTP-26.INETSVCS-FTP

Returns

WUFTP-26.INETSVCS-FTP B.11.00.01.003 Internet Services Fileset

That's not to say that it was there when you downloaded it, but it seems to be now.

Regards,
Berlene