---------- Forwarded message ----------
Date: Fri, 29 Sep 2000 10:01:28 -0400
From: bump <chris@xxxxxxxxxxxxxxxx>
To: BUGTRAQ at SECURITYFOCUS.COM
Subject: [slackware-security] wuftpd vulnerability - Slackware 4.0, 7.0,
7.1, -current
----- Original Message -----
From: "Slackware Security Team" <security@xxxxxxxxxxxxx>
To: <slackware-security at slackware.com>
Sent: Friday, September 29, 2000 3:27 AM
Subject: [slackware-security] wuftpd vulnerability - Slackware 4.0, 7.0,
7.1, -current
A vulnerability involving an input validation error in the "site exec"
command has recently been identified in the wu-ftpd program (CERT Advisory
CA-2000-13). More information about this problem can be found at this site:
http://www.cert.org/advisories/CA-2000-13.html
The wu-ftpd daemon is part of the tcpip1.tgz package in the N series. A
new tcpip1.tgz package is now available in the Slackware -current tree.
All users of Slackware 7.0, 7.1, and -current are stronly urged to upgrade
to the new tcpip1.tgz package.
For users of Slackware 4.0, a wuftpd.tgz patch package is being provided
in the /patches tree of Slackware 4.0.
=========================================
wu-ftpd 2.6.1 AVAILABLE - (n1/tcpip1.tgz)
=========================================
FOR USERS OF SLACKWARE 7.0, 7.1, and -current:
---------------------------------------------
The recent vulnerability in wu-ftpd can be fixed by upgrading to the
new tcpip1.tgz package. This package upgrades the wu-ftpd server to
version 2.6.1. You can download it from the -current branch:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slakware/n1/tcpip1.tgz
All users of Slackware 7.0, 7.1, and -current are strongly urged to
upgrade to the tcpip1.tgz package to fix the vulnerability in wu-ftpd.
For verification purposes, we provide the following checksums:
16-bit "sum" checksum:
301822053 1017853 n1/tcpip1.tgz
128-bit MD5 message digest:
cbb3fe386341d1b1e99100ba3ff02794 n1/tcpip1.tgz
Installation instructions for the tcpip1.tgz package:
If you have downloaded the new tcpip1.tgz package, you should bring
the system into runlevel 1 and run upgradepkg on it:
# telinit 1
# upgradepkg tcpip1.tgz
# telinit 3
FOR USERS OF SLACKWARE 4.0:
--------------------------
The recent vulnerability in wu-ftpd can be fixed by installing the
wuftpd.tgz patch package. This package upgrades the wu-ftpd server
to version 2.6.1. You can download it from the Slackware 4.0 branch:
ftp://ftp.slackware.com/pub/slackware/slackware-4.0/patches/wuftpd.tgz
All users of Slackware 4.0 are strongly urged to install the wuftpd.tgz
patch package to fix the vulnerability in wu-ftpd.
For verification purposes, we provide the following checksums:
16-bit "sum" checksum:
2781503789 107341 wuftpd.tgz
128-bit MD5 message digest:
75547b1762d7ff4fad233cd89529ff2c wuftpd.tgz
Installation instructions for the wuftpd.tgz package:
If you have downloaded the wuftpd.tgz patch package, you should bring
the system into runlevel 1 and run installpkg on it:
# telinit 1
# installpkg wuftpd.tgz
# telinit 3
Remember, it's also a good idea to backup configuration files before
upgrading packages.
- Slackware Linux Security Team
http://www.slackware.com
