WU-FTPD fb_realpath() Off-By-One Buffer Overflow

[Chrisl_2]

HP-UX 11iv2 PARISC

Hi all. I am running wu-ftpd 2.6.1. I have 2 questions on security of this program.

1. My security-patch check tool doesn't alert me to the vulnerability. I download a new catalog every nite, so I am wondering why.

2. If I am understanding the CERT correctly, it seems that I have to install 2.6.2 from HP, then run the wu realpath patch from wu. Has anyone done this, if so, how did it work out?

TIA!

[Chrisl_2]

Anybody? If not, I'll close the thread.

TIA

[Steven Schweda]

I know nothing, but it appears that if I
wanted to learn anything about "the
vulnerability", I'd need to do all my own
research, because you've provided no
references where I might discover about what
you're talking. "[T]he CERT" is a long way
from a link to a description of "the
vulnerability".

And while _I_ may know nothing, I may not be
the only one who's too lazy to go through all
that duplicative effort.

[Jason Haase]

Hi,

I am also inquiring about this, I use a tool called found stone and it sees this WU-FTPD Off-by-one Buffer overflow vulnerability.

It looks like version 11.0 and 11.1 of HU-UX there is a patch for WU-FTP.

I am running 11.23 on Sparc, any body know where I can get a depot for the latest patch for this?