Summary
The remote host is missing an update to wu-ftpd
announced via advisory DSA 457-1.
Solution
https://secure1.securityspace.com/smysecure/catid.html?in=DSA%20457-1
Insight
Two vulnerabilities were discovered in wu-ftpd:
CVE-2004-0148 - Glenn Stewart discovered that users could bypass the directory access restrictions imposed by the restricted-gid option by changing the permissions on their home directory. On a subsequent login, when access to the user's home directory was denied, wu-ftpd would fall back to the root directory.
CVE-2004-0185 - A buffer overflow existed in wu-ftpd's code which deals with S/key authentication.
For the stable distribution (woody) these problems have been fixed in version 2.6.2-3woody4.
For the unstable distribution (sid) these problems have been fixed in version 2.6.2-17.1.
We recommend that you update your wu-ftpd package.
Severity
Classification
-
CVE CVE-2004-0148, CVE-2004-0185 -
CVSS Base Score: 10.0
AV:N/AC:L/Au:N/C:C/I:C/A:C
Related Vulnerabilities