|
|
Family: FTP --> Category: infos
wu-ftpd MAIL_ADMIN overflow Vulnerability Scan
Vulnerability Scan Summary
Checks the banner of the remote wu-ftpd server
Detailed Explanation for this Vulnerability Test
The remote Wu-FTPd server seems to be vulnerable to a remote flaw.
This version fails to properly check bounds on a pathname when Wu-Ftpd is
compiled with MAIL_ADMIN enabled resulting in a buffer overflow. With a
specially crafted request, a possible hacker can possibly execute arbitrary code
as the user Wu-Ftpd runs as (usually root) resulting in a loss of integrity,
and/or availability.
It should be noted that this vulnerability is not present within the default
installation of Wu-Ftpd.
The server must be configured using the 'MAIL_ADMIN' option to notify an
administrator when a file has been uploaded.
*** Nessus solely relied on the banner of the remote server
*** to issue this warning, so it may be a false positive.
Solution : Upgrade to Wu-FTPd 2.6.3 when available
Threat Level: High
Click HERE for more information and discussions on this network vulnerability scan.
|
