Subject: upgrade?

From: "Speier, Guy J - CNF" <[email-masked]>
Date: Thu, 28 May 1998 11:33:40 -0700

Could someone please advise me on weather
I should upgrade a machine currently running
wu-ftp 2.4(2) to the latest version.

What would be the benefits?  Are there any security
enhancements?

thanks
Guy

---

From: Gregory A Lundberg <[email-masked]>
Date: Thu, 28 May 1998 16:18:47 -0400 (EDT)

> What would be the benefits?  Are there any security

Lots and lots of security enhancements.  Check out this one reference:
  http://www.cert.org/advisories/CA-97.27.FTP_bounce.html
quoting:

   The CERT/CC staff urges you to install a comprehensive patch if one is
   available. Until then, we recommend the wu-ftpd package identified in
   Section III.B. as a workaround. 

and:

   The wu-ftpd package addresses the FTP bounce problem by ensuring that
   the PORT command cannot be used to establish connections to machines
   other than the originating client. Please read the wu-ftpd README file
   "FIXES-2.4-HOBBIT" before installing the package. 

   The latest version of wu-ftpd, which we recommend, is available from

   ftp://ftp.academ.com/pub/wu-ftpd/private/wu-ftpd-2.4.2-beta-16.tar..Z

CERT Advisories seem a good enough reason to me to upgrade.

----

Gregory A Lundberg		Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195