Vulnerability Scanning Solutions, LLC.
Home
Our Process
Residential
Corporate
What We Scan For
Sample Report
Client List
Terms
Contact Us
What We Scan For
Family: Fedora Local Security Checks --> Category: infos

Fedora Core 1 2003-034: lftp Vulnerability Scan


Vulnerability Scan Summary
Check for the version of the lftp package

Detailed Explanation for this Vulnerability Test

The remote host is missing the patch for the advisory FEDORA-2003-034 (lftp).

LFTP is a sophisticated ftp/http file transfer program. Like bash, it
has job control and uses the readline library for input. It has
bookmarks, built-in mirroring, and can transfer several files in
parallel. It is designed with reliability in mind.


Update Information:

Ulf Härnhammar found a remotely-triggerable buffer overflow in lftp.

A possible hacker could create a carefully crafted directory on a website
such that, if a user connects to that directory using the lftp client
and subsequently issues a 'ls' or 'rels' command, the attacker could
execute arbitrary code on the users machine. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned
the name CVE-2003-0963 to this issue.

Users of lftp are advised to upgrade to these erratum packages, which
upgrade lftp to a version which is not vulnerable to this issue.

Red Hat would like to thank Ulf Härnhammar for discovering and
alerting us to this issue.



Solution : http://www.fedoranews.org/updates/FEDORA-2003-034.shtml
Threat Level: High

Click HERE for more information and discussions on this network vulnerability scan.

VSS, LLC.

P.O. Box 827051

Pembroke Pines, FL 33082-7051

Vulnerability Scanning Solutions, LLC.