|
From: pollux <po...@wz...> - 2004-02-15 19:57:08
|
WZDFTPD Security Advisory 2004-02
Topic: possible buffer overflow in LIST command
Version: wzdftpd-cvs: prior Feb, 15 2004
wzdftpd 0.2.1
wzdftpd 0.2
wzdftpd < 0.2
Platform: all platforms
Severity: high
Fixed: wzdftpd-cvs: Feb, 15 2004
wzdftpd 0.2.2
Details:
wzdftpd accepts arguments for the LIST command.
However, length was not correctly tested and can lead to a buffer overflow by
sending a huge buffer.
Successful exploitation may allow execution of arbitrary code on an
affected system, with server privileges.
Fix:
update to lastest CVS version, or 0.2.2
Patch is attached.
Acknowledgements:
Thanks to the ecl-il team for reporting us the problem, and
providing many usefull informations.
|