wu-ftp vulnerability HPUX 11.??

[Joseph C. Denman]

Has everyone seen this????

http://securitytracker.com/alerts/2002/Jan/1003333.html

...jcd...

[Sanjay_6]

Hi Joseph,

I think hp has suggested some fix over here,

http://us-support2.external.hp.com/cki/bin/doc.pl/sid=ec6adf23080dfd7d6f/screen=ckiDisplayDocument?docId=200000058808045

hope this helps.

Regds

[eran maor · Accepted solution]

Hi

here is how to tell if you are runnig wu-ftp :

telnet to the host on port 21

#telnet hostname 21

What returns if you are running WU-FTPD is

220 hostname.com FTP server (Version wu-2-4-20VR17(1) Mon Apr 19 09:21:53 EDT
1999) ready.

If not, you will see:

220 hostname.com FTP server (version 1.1.214.2 Mon May 11 12:21:14 GMT 1998)
ready


Fixing the problem
To determine if wu-ftpd version 2.6 is installed on a system:

what /usr/lbin/ftpd | grep wuftpd-2.6

If version 2.6 IS installed, then apply the latest web
upgrade now. Registration for the download is necessary:

http://www.software.hp.com/

and search on "wu-ftpd" (without the quotes)

or:

http://www.software.hp.com/cgi-bin/swdepot_parser.cgi/cgi/displayProductInfo
.pl?productNumber=WUFTPD26

If revision 2.6 is NOT installed, then make sure you have
installed the current patches for HP Security Bulletin
"HPSBUX0107-162 Security Vulnerability in ftpd".