CVE-2001-0550 wu-ftpd 2.6.1 allows remote attackers to execute arbitrary commands via a "~{" argument to commands such as CWD, which is not properly handled by the glob function (ftpglob).
HighCVSS 7.5
EPSS 74.1%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
wu-ftpd 2.6.1 allows remote attackers to execute arbitrary commands via a "~{" argument to commands such as CWD, which is not properly handled by the glob function (ftpglob).
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| david madore ftpd-bsd | = 0.3.2 | No fix listed |
| david madore ftpd-bsd | = 0.3.3 | No fix listed |
| washington university wu-ftpd | = 2.5.0 | No fix listed |
| washington university wu-ftpd | = 2.6.0 | No fix listed |
| washington university wu-ftpd | = 2.6.1 | No fix listed |
References
- CLA-2001:442 vendor-advisory
- IMNX-2001-70-036-01 vendor-advisory
- 20011128 CORE-20011001: Wu-FTP glob heap corruption vulnerability mailing-list
- CSSA-2001-041.0 patch vendor-advisory
- CA-2001-33 patch third-party-advisory us-government-resource
- DSA-087 vendor-advisory
- VU#886083 patch third-party-advisory us-government-resource
- MDKSA-2001:090 vendor-advisory
- SuSE-SA:2001:043 vendor-advisory
- RHSA-2001:157 patch vendor-advisory
- 20010430 some ftpd implementations mishandle CWD ~{ mailing-list
- 3581 exploit patch vdb-entry vendor-advisory
- HPSBUX0107-162 vendor-advisory
- wuftp-glob-heap-corruption(7611) vdb-entry