OSVDB ID: 5742 Title: WU-FTPD QUOTE PASV Forced Core Dump Information Disclosure |
Info |
|
|
Dates |
||||
|
|
Description |
A remote overflow exists in WU-FTPD. WU-FTP fails to handle QUOTE PASV requests for logged in users, resulting in a memory overflow. With a specially crafted request, an attacker can cause the daemon to dump core and die. The core file will contain the usernames and password of all users on the system. These endstates are a loss of confidentiality, and availability. |
Classification |
Location:
Remote / Network Access
Attack Type: Information Disclosure, Input Manipulation Impact: Loss of Confidentiality, Loss of Availability Exploit: Exploit Public Disclosure: OSVDB Verified |
Solution |
Upgrade to version 2.6.2 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds. |
Products |
|
References |
|
Credit |
Unknown or Incomplete |