Subject: INFO##96.21049 Re: Potential security hole in wu-ftpd

From: CERT(sm) Coordination Center <[email-masked]>
Date: Thu, 12 Sep 96 17:00:23 EDT

-----BEGIN PGP SIGNED MESSAGE-----

Hello Michael:

Thank you for your report concerning a potential vulnerability
in wu-ftpd:
 
> I have recently discovered a limited-circumstances variation of the
> old ftpd double-login bug in wuftpd 2.4 (running under Solaris 2.5).
> This bug was fixed before the CERT came into existence, so I am rather
> surprised to see it years later.
> 
> The variation I've found recently appears like this:
> 
> # ftp ftp
> Connected to ftp.
> 220 ftp FTP server (Version wu-2.4(1) Wed Sep 4 14:09:00 EDT 1996) ready.
> Name (ftp:root): root
> 530 User root access denied.
> Login failed.
> ftp> user root
> 331 Password required for root.
> Password: <root's password here>
> 230 User root logged in.
> ftp> 
> 
> Root was blocked the first time, but upon a second attempt, root is
> allowed in (with root's password).

We have assigned an internal reference number to this vulnerability
and it's included in the subject line above.  This unique, random
number will help us track correspondence and coordinate our
activities. We would appreciate your including it in the subject line
of future correspondence about this vulnerability.

Can you tell us if you are using the latest beta release?

System Name:            wuftpd
Current Version:        2.4.2-beta-11
Date of Report:         April 15, 1996
Primary Archive Site:   ftp://ftp.academ.com/pub/wu-ftpd/private/wu-ftpd-2.4.2-beta-11.tar.Z
MD5 Checksum:           cf27dcaf16f2b0ab76f0036385abcfdf

Regards,
Georgia
==============================================================================
Georgia Killcrece

CERT(sm) Coordination Center    | Telephone: +1-412-268-7090 24-hour hotline
Software Engineering Institute  | CERT Coordination Center personnel answer
Carnegie Mellon University      | business days 08:30-17:00 EST/EDT
Pittsburgh, PA 15213-3890       | (GMT-5)/(GMT-4), on call for emergencies
U.S.A.                          | during other hours.
Internet E-mail: [email-masked]  | Fax: +1-412-268-6989

CERT is a service mark of Carnegie Mellon University.

The CERT Coordination Center is sponsored by the Defense Advanced
Research Projects Agency (DARPA). The Software Engineering Institute
is sponsored by the U.S.  Department of Defense.