Re: [TCLUG:4108] CERT Advisory CA-99.03 - FTP-Buffer-Overflows (fwd)(LONG)

[Jelly Donut <jellyd@jellyd.org>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Sometime around the 11th of February in 1999, a certain Jim Raney said:

: [Affected Systems]
:
: Any server running the latest version of ProFTPD (1.2.0pre1) or the
: latest version of Wuarchive ftpd (2.4.2-academ[BETA-18]).  wu-ftpd is
: installed and enabled by default on most Linux variants such as RedHat
: and Slackware Linux.  ProFTPD is new software recently adopted by many
: major internet companies for its improved performance and reliability.

[snip]

: % wu-ftpd
:
:   Current version: 2.4.2 (beta 18), unknown release date.
:   All versions through 2.4.2 (beta 18): vulnerability dependant upon
:     target platform, probably vulnerable either due to OS-provided
:     runtime vulnerability or through use of replacement code supplied
:     with the source kit.  No patches have been made available.
:   Fix: unknown.
:
:   Currently recommended action: Upgrade to wu-ftpd VR series.
:
:   % wu-ftpd VR series
:
:     Current version: 2.4.2 (beta 18) VR13, released January 28, 1999.
:     All versions prior to 2.4.2 (beta 18) VR10: vulnerable.
:     Fix: incorporated into VR10, released November 1, 1998.
:
:     Available from:
:         ftp://ftp.vr.net/pub/wu-ftpd/
:     Filenames:
:         wu-ftpd-2.4.2-beta-18-vr13.tar.Z
:         wu-ftpd-2.4.2-beta-18-vr13.tar.gz

This has been bothering me for a few days, since I heard about this. ..
I'm running normal, non-VR wu-ftpd .. but mine says it's version 2.6.0
(the tarball, the source directory, the README, when you login to it ..)
and I installed it back in September. Do I maybe have a .. fake (?)
wu-ftpd ?

The README says:

- --------8<-------
WASHINGTON UNIVERSITY FTP SERVER, RELEASE 2.6.0 -- May, 1998

[snip features/maintainers of wu-ftpd]

We have introduced a new version numbering scheme based on the one used in
Linux - versions with an even minor number (2.6.x, 2.8.x, ...) are
considered stable. There will not be any major features added in them,
only bugs fixed.

Versions with odd minor numbers (2.7.x, 2.9.x, ...) are experimental
versions, primarily there to test new features and major changes. If you
need a reliable ftp server, don't use them unless you absolutely need one
of
their features.
- -------8<-------


Anything you've heard that might shed some light on this situation would
be greatly appreciated.

- --
[------------------------------------------------------------------------]
| Josh Becker                      - aka -                        JellyD |
| email: jellyd@jellyd.org                            IRC: EFnet, DALnet |
[------------------------------------------------------------------------]
-----BEGIN PGP SIGNATURE-----
Version: GNUPG v0.4.3 (GNU/Linux)
Comment: For info finger gcrypt@ftp.guug.de

iD8DBQE2xEkzcmkpI69BOLwRAlIgAKC6Kt1eFhe+z/PoJiA9w7cWMh3XXgCfToL7
lp/v5bibuFAzkwEgoHjW4yA=
=gJ/u
-----END PGP SIGNATURE-----