Subject: Re: Possible WU-ftpd Worm ?

From: Gregory A Lundberg <[email-masked]>
Date: Wed, 14 Apr 1999 13:55:40 -0400 (EDT)

---------- Forwarded message ----------
Date: Wed, 14 Apr 1999 13:51:46 -0400 (EDT)
From: Gregory A Lundberg <[email-masked]>
To: Stu Alchor <[email-masked]>
Cc: [email-masked],
    WU-FTPD Discussion List <[email-masked]>,
    WU-FTPD Questions <[email-masked]>
Subject: Re: Possible WU-ftpd Worm ?

On Wed, 14 Apr 1999, Stu Alchor wrote:

> As I've run the old ftp exploit I found in the bugtraq and they didn't
> work so I thought we were not vulnerable. I will attach the core of
> the ftp worm (SDI-wu.c), the exploit for the vulnerability, which,
> btw, worked in my host.

>   strcpy ( tmp, "MKD "); strcat ( tmp, buff); strcat ( tmp, "\n");

This is the realpath() overflow discussed in

  http://www.cert.org/advisories/CA-99-03-FTP-Buffer-Overflows.html

Please review that document to determine if your version of the WU-FTPD
daemon is vulnerable.

The addition of a backdoor (if true) is new, however.

Anyone wishing to discuss this matter may contact me through either of the
WU-FTPD discussion lists cc'd above or through private email.

The location of the latest version of wu-ftpd can be found in the 
directory
 
      ftp://ftp.vr.net/pub/wu-ftpd/
 
wu-ftpd Resource Center:  http://www.landfield.com/wu-ftpd/
wu-ftpd FAQ:              http://www.cetis.hvu.nl/~koos/wu-ftpd-faq.html
wu-ftpd list archive:     http://www.landfield.com/wu-ftpd/mail-archive/

-- 

Gregory A Lundberg
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-888-977-5370