Subject: wuarchive-ftp 2.4 vs. wu-ftp 2.5.0

From: Joost Houwen <[email-masked]>
Date: Thu, 15 Jul 1999 13:18:09 -0700 (PDT)

I am wondering if someone can clarify the following for me (I have
checked the FAQ and list archives but no luck.)

Many _current_ security resources recommend the wuarchive-ftp 2.4
(ftp://wuarchive.wustl.edu/packages/wuarchive-ftpd/), but in the wu-ftp
2.5.0 release announcement it is strongly recommended to upgrade.  This
makes sense to me because the wustl archive files are circa 1997.

Are there specific issues that the "wuarchive" version has?  The recent
CERT bulletin did not specifically address this issue, but focused on the
problems with 2.4.2 and others.  I have checked a variety of the
vulnerability databases, but there seems to be nothing specific.

In general it seems to me a very good idea to use 2.5.0, but I am
wondering if there are any specific security vulnerability issues which
clearly make the case for upgrading? 

Thanks,
Joost

---

From: Gregory A Lundberg <[email-masked]>
Date: Thu, 15 Jul 1999 16:45:33 -0400

> clearly make the case for upgrading? 

Any resource which does not recommend 2.5.0 is NOT a current security
resource.  At a minimum, you should be running 2.4.2-beta-18-VR12 as is
stated in the latest CERT advisory.  If you find a site recommending
anything prior to 2.4.2-beta-18-VR12, you should notify the site maintainer
that their information is out-of-date and misleading.

For a full history of the security recommendations, please read the CERT
archives at http://www.CERT.org/

TO BE PERFECTLY CLEAR:

ANYONE RUNNING VERSION 2.4 OF THE DAEMON SHOULD EITHER UPGRADE OR
DISCONTINUE FTP SERVICES **IMMEDEATELY**.

Anyone running ANY version of the daemon prior to those recommended in the
last CERT advisory (CA-99-02) should immedeately upgrade or discontinue all
FTP services.

-- 

Gregory A Lundberg              WU-FTPD Development Group
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195