[SA12226] tnftpd Signal Handling Privilege Escalation Vulnerabilities

2004-08-19T00:00:00
ID SECURITYVULNS:DOC:6623
Type securityvulns
Reporter Securityvulns
Modified 2004-08-19T00:00:00

Description

TITLE: tnftpd Signal Handling Privilege Escalation Vulnerabilities

SECUNIA ADVISORY ID: SA12226

VERIFY ADVISORY: http://secunia.com/advisories/12226/

CRITICAL: Moderately critical

IMPACT: System access, Privilege escalation

WHERE: >From remote

SOFTWARE: tnftpd http://secunia.com/product/3800/

DESCRIPTION: Przemyslaw Frasunek has reported some vulnerabilities in tnftpd (also known as lukemftpd), which potentially can be exploited by malicious users to gain escalated privileges or compromise a vulnerable system.

The vulnerabilities are caused due to various race condition errors within the out-of-band signal handling code.

Successful exploitation may allow execution of FTP commands or arbitrary code with the privileges of the tnftpd process.

SOLUTION: Update to release 20040809 or later. http://freshmeat.net/projects/tnftpd/

PROVIDED AND/OR DISCOVERED BY: Przemyslaw Frasunek


About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.

Subscribe: http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/

Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.