To: bugtraq@securityfocus.com announce@lists.caldera.com scoannmod@xenitec.on.ca ___________________________________________________________________________ Caldera International, Inc. Security Advisory Subject: OpenServer: wu-ftpd ftpglob() vulnerability Advisory number: CSSA-2002-SCO.1 Issue date: 2002 January 10 Cross reference: ___________________________________________________________________________ 1. Problem Description A vulnerability in the wu-ftpd ftpglob() function was found by the CORE ST team. This vulnerability can be exploited to obtain root access on the ftp server. 2. Vulnerable Versions Operating System Version Affected Files ------------------------------------------------------------------ OpenServer <= 5.0.6a /etc/ftpd 3. Workaround None. 4. OpenServer 4.1 Location of Fixed Binaries ftp://stage.caldera.com/pub/security/openserver/CSSA-2002-SCO.1/ 4.2 Verification MD5 (erg711907.tar) = 577a93a058d37283037be476b9e54298 md5 is available for download from ftp://stage.caldera.com/pub/security/tools/ 4.3 Installing Fixed Binaries Upgrade the affected binaries with the following commands: Download erg711907.tar to /tmp # cd /tmp # tar xvf erg711907.tar # custom Instruct custom to install from images, and supply /tmp as the directory of the VOL images. 5. References CORE-20011001: Wu-FTP glob heap corruption vulnerability http://www.corest.com CERT Advisory CA-2001-33 Multiple Vulnerabilities in WU-FTPD http://www.cert.org http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0550 This and other advisories are located at http://stage.caldera.com/support/security This advisory addresses Caldera Security internal incidents sr856022, SCO-559-1331, erg711907. 6. Disclaimer Caldera International, Inc. is not responsible for the misuse of any of the information we provide on our website and/or through our security advisories. Our advisories are a service to our customers intended to promote secure installation and use of Caldera International products. 7. Acknowledgements This vulnerability was originally reported by Matt Power of BindView on the vuln-dev mailing list. ___________________________________________________________________________
Attachment:
pgp00070.pgp
Description: PGP signature
