A local off-by-one overflow exists in WU-FTPD. The fb_realpath() function fails to validate user input resulting in a buffer overflow. With a specially crafted request, an attacker can cause arbitrary code execution resulting in a loss of integrity.

Upgrade to version 2.6.2-12 (Available on some Linux distributions) or higher, as it has been reported to fix this vulnerability. In addition, WU-FTPD Development Group has released a patch for some older versions of the primary distribution.

• ISS X-Force ID: 12785
• CVE ID: 2003-0466 (see also: NVD)
• SCIP VulDB ID: 218
• Related OSVDB ID: 6602
• Exploit Database: 74 78
• Milw0rm: 74 78
• CERT VU: 743092
• Bugtraq ID: 8315
• Secunia Advisory ID: 9406 9521 9535
• Vendor Specific Solution URL: ftp://ftp.wu-ftpd.org/pub/wu-ftpd/patches/apply_to_2.6.2/realpath.patch
• Generic Informational URL: http://isec.pl/vulnerabilities/isec-0011-wu-ftpd.txt
• Mail List Post: http://marc.theaimsgroup.com/?l=bugtraq&m=105967301604815&w=2
• Generic Exploit URL: http://marc.theaimsgroup.com/?l=bugtraq&m=106001702232325&w=2
  http://www.frsirt.com/exploits/08.11.0x82-wu262-advanced.c.php
• Vendor Specific Advisory URL: http://www.debian.org/security/2003/dsa-357
  http://www.mandrakesoft.com/security/advisories?name=MDKSA-2003:080
  http://www.suse.de/de/security/2003_032_wuftpd.html
  http://www.turbolinux.com/security/TLSA-2003-46.txt
  http://your.hp.com/m/S.asp?HB14091692265X3612511X395967
  https://rhn.redhat.com/errata/RHSA-2003-245.html
• Vendor URL: http://www.wuftpd.org/
• CIAC Advisory: n-132

• Wojciech Purczynski - cliphisec.pl - isec.pl
• Janusz Niewiadomski - funkyshisec.pl - Isec