===================================================================== CERT-Renater Note d'Information No. 2005/VULN235 _____________________________________________________________________ DATE : 06/04/2005 HARDWARE PLATFORM(S) : / OPERATING SYSTEM(S) : Systems running wu-ftpd. ====================================================================== - - -------------------------------------------------------------------------- Debian Security Advisory DSA 705-1 security@debian.org http://www.debian.org/security/ Martin Schulze April 4th, 2005 http://www.debian.org/security/faq - - -------------------------------------------------------------------------- Package : wu-ftpd Vulnerability : missing input sanitising Problem-Type : remote Debian-specific: no CVE IDs : CAN-2005-0256 CAN-2003-0854 Several denial of service conditions have been discovered in wu-ftpd, the popular FTP daemon. The Common Vulnerabilities and Exposures project identifies the following problems: CAN-2005-0256 Adam Zabrocki discovered a denial of service condition in wu-ftpd that could be exploited by a remote user and cause the server to slow down the server by resource exhaustion. CAN-2003-0854 Georgi Guninski discovered that /bin/ls may be called from within wu-ftpd in a way that will result in large memory consumption and hence slow down the server. For the stable distribution (woody) these problems have been fixed in version 2.6.2-3woody5. For the unstable distribution (sid) these problems have been fixed in version 2.6.2-19. We recommend that you upgrade your wu-ftpd package. Upgrade Instructions - - -------------------- wget url will fetch the file for you dpkg -i file.deb will install the referenced file. If you are using the apt-get package manager, use the line for sources.list as given below: apt-get update will update the internal database apt-get upgrade will install corrected packages You may use an automated update by adding the resources from the footer to the proper configuration. Debian GNU/Linux 3.0 alias woody - - -------------------------------- Source archives: http://security.debian.org/pool/updates/main/w/wu-ftpd/wu-ftpd_2.6.2-3woody5.dsc Size/MD5 checksum: 607 78463b3882e0d32102344bb0580e0d98 http://security.debian.org/pool/updates/main/w/wu-ftpd/wu-ftpd_2.6.2-3woody5.diff.gz Size/MD5 checksum: 101661 967b719c02892c867ad0d6456a5dd47a http://security.debian.org/pool/updates/main/w/wu-ftpd/wu-ftpd_2.6.2.orig.tar.gz Size/MD5 checksum: 354784 b3c271f02aadf663b8811d1bff9da3f6 Architecture independent components: http://security.debian.org/pool/updates/main/w/wu-ftpd/wu-ftpd-academ_2.6.2-3woody5_all.deb Size/MD5 checksum: 3484 cc6ee1aeb156077af311870f095840ab Alpha architecture: http://security.debian.org/pool/updates/main/w/wu-ftpd/wu-ftpd_2.6.2-3woody5_alpha.deb Size/MD5 checksum: 292630 c164f9f2d0ae5d70587ca49ddbe543b4 ARM architecture: http://security.debian.org/pool/updates/main/w/wu-ftpd/wu-ftpd_2.6.2-3woody5_arm.deb Size/MD5 checksum: 265840 c86cdbc78969f755dce0facce4a1f882 Intel IA-32 architecture: http://security.debian.org/pool/updates/main/w/wu-ftpd/wu-ftpd_2.6.2-3woody5_i386.deb Size/MD5 checksum: 255216 504af14aec48191405c08a56845d330b Intel IA-64 architecture: http://security.debian.org/pool/updates/main/w/wu-ftpd/wu-ftpd_2.6.2-3woody5_ia64.deb Size/MD5 checksum: 321932 ced4192d937ccedfa5a7ab2e9e77c378 HP Precision architecture: http://security.debian.org/pool/updates/main/w/wu-ftpd/wu-ftpd_2.6.2-3woody5_hppa.deb Size/MD5 checksum: 276624 4a1b5b6115ed1d93206c9787e8d37038 Motorola 680x0 architecture: http://security.debian.org/pool/updates/main/w/wu-ftpd/wu-ftpd_2.6.2-3woody5_m68k.deb Size/MD5 checksum: 249810 e873e950d3b234a7854ee0e4810783f5 Big endian MIPS architecture: http://security.debian.org/pool/updates/main/w/wu-ftpd/wu-ftpd_2.6.2-3woody5_mips.deb Size/MD5 checksum: 273426 364c07d6a21f8aab43b3841ce98df8c6 Little endian MIPS architecture: http://security.debian.org/pool/updates/main/w/wu-ftpd/wu-ftpd_2.6.2-3woody5_mipsel.deb Size/MD5 checksum: 273568 4e51f44342035b6ecafc624b1a6c06f3 PowerPC architecture: http://security.debian.org/pool/updates/main/w/wu-ftpd/wu-ftpd_2.6.2-3woody5_powerpc.deb Size/MD5 checksum: 268816 4072fbbb73bd8013b9a191f3aa7bd778 IBM S/390 architecture: http://security.debian.org/pool/updates/main/w/wu-ftpd/wu-ftpd_2.6.2-3woody5_s390.deb Size/MD5 checksum: 263638 d86fc84ab2974a80fd7407d826d8b003 Sun Sparc architecture: http://security.debian.org/pool/updates/main/w/wu-ftpd/wu-ftpd_2.6.2-3woody5_sparc.deb Size/MD5 checksum: 270784 1110401bccc9035cc1b30eb8146aee18 These files will probably be moved into the stable distribution on its next update. - - --------------------------------------------------------------------------------- For apt-get: deb http://security.debian.org/ stable/updates main For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main Mailing list: debian-security-announce@lists.debian.org Package info: `apt-cache show ' and http://packages.debian.org/ ====================================================================== ========================================================= Les serveurs de référence du CERT-Renater http://www.urec.fr/securite http://www.cru.fr/securite http://www.renater.fr ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 151 bd de l'Hopital | fax : 01-53-94-20-41 + + 75013 Paris | email: certsvp@renater.fr + =========================================================