Subject: recent CERT advisory

From: Jason Spears <[email-masked]>
Date: Mon, 9 Jun 1997 12:47:04 -0400 (EDT)

Someone appears to have recently gained root access to a machine running
2.4.  I have upgraded to 2.4.2-beta13.

Does anyone have details about the exploit used against 2.4?  I'd like to
determine if the ftpd was really the problem in this instance, or whether I
need to keep looking.

Thanks,

Jason Spears

---

From: Mark Galbraith <[email-masked]>
Date: 09 Jun 1997 13:06:34 -0700

>>>>> "Jason" == Jason Spears <[email-masked]> writes:

Jason> Someone appears to have recently gained root access to a machine running
Jason> 2.4.  I have upgraded to 2.4.2-beta13.

Jason> Does anyone have details about the exploit used against 2.4?  I'd like to
Jason> determine if the ftpd was really the problem in this instance, or whether I
Jason> need to keep looking.

Please let me know what you find out.  I'm also looking to upgrade to
beta13, but I'm having trouble convincing my manager it's a good idea.
Perhaps some of the exploit capabilities would be enough of a shocker to
break the ice.

-- 
Mark Galbraith                   Member of The HTML Writers Guild
Engineer, Internet Services	              http://www.hwg.org/
Triad Systems Corporation
(PGP Fingerprint=1CB9 7481 AD5C 5709  690B AC09 7F65 D6F6)

---

From: Kent Landfield <[email-masked]>
Date: Mon, 9 Jun 1997 17:25:25 -0500 (CDT)

# 
# >>>>> "Jason" == Jason Spears <[email-masked]> writes:
# 
# Jason> Someone appears to have recently gained root access to a machine running
# Jason> 2.4.  I have upgraded to 2.4.2-beta13.
# 
# Jason> Does anyone have details about the exploit used against 2.4?  I'd like to
# Jason> determine if the ftpd was really the problem in this instance, or whether I
# Jason> need to keep looking.
# 
# Please let me know what you find out.  I'm also looking to upgrade to
# beta13, but I'm having trouble convincing my manager it's a good idea.
# Perhaps some of the exploit capabilities would be enough of a shocker to
# break the ice.

Take a look at the Advisories page in the Resource Center.
http://www.landfield.com/cert/

It has all the CERT advisories listed that pertain to wu-ftpd.
If you are running vanilla 2.4 then you need to convince him in a
hurry...

-- 
Kent Landfield                        Phone: 1-817-545-2502             
The Landfield Group                   FAX:   1-817-545-7650             
Email: [email-masked]             http://www.landfield.com/
Please send comp.sources.misc related mail to [email-masked].
Search the Usenet Hypertext FAQ Archive at http://www.faqs.org/faqs/