Test ID:	1.3.6.1.4.1.25623.1.0.53663
Category:	Debian Local Security Checks
Title:	Debian Security Advisory DSA 377-1 (wu-ftpd)
Summary:	The remote host is missing an update to wu-ftpd;announced via advisory DSA 377-1.
Description:	Summary: The remote host is missing an update to wu-ftpd announced via advisory DSA 377-1. Vulnerability Insight: wu-ftpd, an FTP server, implements a feature whereby multiple files can be fetched in the form of a dynamically constructed archive file, such as a tar archive. The names of the files to be included are passed as command line arguments to tar, without protection against them being interpreted as command-line options. GNU tar supports several command line options which can be abused, by means of this vulnerability, to execute arbitrary programs with the privileges of the wu-ftpd process. Georgi Guninski pointed out that this vulnerability exists in Debian woody. For the stable distribution (woody) this problem has been fixed in version 2.6.2-3woody2. For the unstable distribution (sid) this problem will be fixed soon. We recommend that you update your wu-ftpd package. Solution: Please install the updated package(s). CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-1999-0997 Bugtraq: 19991220 Security vulnerability in certain wu-ftpd (and derivitives) configurations (fwd) (Google Search) Debian Security Information: DSA-377 (Google Search) http://www.debian.org/security/2003/dsa-377 XForce ISS Database: wuftp-ftp-conversion
Copyright	Copyright (C) 2008 E-Soft Inc.

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.