PT-2001-1752 · Washington University · Wu-Ftpd

Published 2001-11-30 · Updated 2018-05-03 · CVE-2001-0550

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: wu-ftpd version 2.6.1

Description: The issue allows remote attackers to execute arbitrary commands by providing a "~{" argument to commands such as CWD. This is due to improper handling by the glob function (ftpglob).

Recommendations: For wu-ftpd version 2.6.1, consider restricting access to the CWD command or disabling the ftpglob function until a patch is available. Avoid using the "~{" argument in commands to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2001-0550

Affected Products

Wu-Ftpd

References · 17

• 🔥 https://exploit-db.com/exploits/21161 · Exploit
• 🔥 https://exploit-db.com/exploits/348 · Exploit
• 🔥 http://securityfocus.com/bid/3581 · Exploit
• http://debian.org/security/2001/dsa-087 · Vendor Advisory
• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000442 · Vendor Advisory
• http://caldera.com/support/security/advisories/CSSA-2001-041.0.txt · Vendor Advisory
• http://cert.org/advisories/CA-2001-33.html · Patch
• http://novell.com/linux/security/advisories/2001_043_wuftpd_txt.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2001-0550 · Security Note
• http://linux-mandrake.com/en/security/2001/MDKSA-2001-090.php3 · Vendor Advisory
• http://www1.itrc.hp.com/service/cki/docDisplay.do?docId=HPSBUX0107-162 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2001-157.html · Vendor Advisory
• http://kb.cert.org/vuls/id/886083 · Patch
• http://download.immunix.org/ImmunixOS/7.0/updates/IMNX-2001-70-036-01 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/7611 · Note