Date: Wed, 28 Nov 2001 18:01:48 -0800
From: Immunix Security Team <[email protected]>
To: [email protected], [email protected],
Subject: Immunix OS 7.0 wu-ftpd update
--7mjWZ9NKzhEjSVTm
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
-----------------------------------------------------------------------
Immunix OS Security Advisory
Packages updated: wu-ftpd
Affected products: Immunix 7.0
Bugs fixed: immunix/1861
Date: Wed Nov 28 2001
Advisory ID: IMNX-2001-70-036-01
Author: Seth Arnold <[email protected]>
-----------------------------------------------------------------------
Description:
CORE Security Technologies has found an heap overflow problem in
wu-ftpd, related to the internal globbing functions. Because this is a
heap overflow, StackGuard does not prevent any possible exploits from
working.
Thomas Biege from SuSE has also discovered several format-string
problems that may or may not be remotely exploitable; these problems
were also found independently by someone else, who sadly is unknown to
WireX.
The wu-ftpd packages provided here fix these problems, as well as
other lesser problems.
References: http://www.securityfocus.com/archive/1/242750
Package names and locations:
Precompiled binary packages for Immunix 7.0 are available at:
http://download.immunix.org/ImmunixOS/7.0/updates/RPMS/wu-ftpd-2.6.1-6_im=
nx_4.i386.rpm
Source package for Immunix 7.0 is available at:
http://download.immunix.org/ImmunixOS/7.0/updates/SRPMS/wu-ftpd-2.6.1-6_i=
mnx_4.src.rpm
Immunix OS 7.0 md5sums:
c6c2fa2fa60f2cfe5b496ad0281fa486 RPMS/wu-ftpd-2.6.1-6_imnx_4.i386.rpm
e8a2e0a1f8abe59ad058b6fecc8a1c72 SRPMS/wu-ftpd-2.6.1-6_imnx_4.src.rpm
GPG verification: =
=20
Our public key is available at <http://wirex.com/security/GPG_KEY>;. =
=20
*** NOTE *** This key is different from the one used in advisories =
=20
IMNX-2001-70-020-01 and earlier.
Online version of all Immunix 6.2 updates and advisories:
http://immunix.org/ImmunixOS/6.2/updates/
Online version of all Immunix 7.0-beta updates and advisories:
http://immunix.org/ImmunixOS/7.0-beta/updates/
Online version of all Immunix 7.0 updates and advisories:
http://immunix.org/ImmunixOS/7.0/updates/
NOTE:
Ibiblio is graciously mirroring our updates, so if the links above are
slow, please try:
ftp://ftp.ibiblio.org/pub/Linux/distributions/immunix/
or one of the many mirrors available at:
http://www.ibiblio.org/pub/Linux/MIRRORS.html
ImmunixOS 6.2 is no longer officially supported.
Contact information:
To report vulnerabilities, please contact [email protected]. WireX=20
attempts to conform to the RFP vulnerability disclosure protocol
<http://www.wiretrip.net/rfp/policy.html>;.
--7mjWZ9NKzhEjSVTm
Content-Type: application/pgp-signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org
iEYEARECAAYFAjwFlwsACgkQVQcWL60UVMufJACeLJv+ziDyYB9GhkTtCSa25aA+
nlcAoINCaogWyRieXFnuSuFVtXxgOmmK
=nQBB
-----END PGP SIGNATURE-----
--7mjWZ9NKzhEjSVTm--
