Re: [cobalt-security] "Security is easy"

[Gossi The Dog <gossi@xxxxxxxxxxxxxx>]

On Wed, 7 Mar 2001, Jeff Lovell wrote:

> On Wed, 07 Mar 2001, Gossi The Dog wrote:
>
> > WuFTPD 2.6.1(1) [latest version] exploit just appeared on Bugtraq.  No
> > patch from developers available.  Hey, prepare to have some 14 year old
> > own your network...
> >
> > I'm unsure what RaQs this effects - I *THINK* It's RaQ1 and 2.  Oh, and of
> > course it effects Redhat.
>
> The following products have wu-ftpd:
>
> 2700CR - CacheRaQ1
> 2700WG - Qube1
> 2800CR - CacheRaQ2
>
> All other products use proftpd.

Ok, ta Jeff.  Obvious effects on non-i386 are minimized a bit due to
shellcode not working etc.  I'm playing with the exploit on a Mandrake 7.1
box here, can't get it working.  If the exploit is legit, it looks like
yet another site exec bug, which makes the 3rd bug in the same function in
just under 2 years.

I tried it on owned.lab6.com for a laugh - actually reported it was vun,
but failed.  Obviously, it failed because of the lack of the exec command
in Proftpd.