CVE-2004-0148 wu-ftpd 2.6.2 and earlier, with the restricted-gid option enabled, allows local users to bypass access restrictions by changing the permissions to prevent access to their home directory, which causes....
HighCVSS 7.2
EPSS 0.44%
- Published
- Updated
- Exploit status
- No public exploit known
Description
wu-ftpd 2.6.2 and earlier, with the restricted-gid option enabled, allows local users to bypass access restrictions by changing the permissions to prevent access to their home directory, which causes wu-ftpd to use the root directory instead.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sgi propack | = 2.3 | No fix listed |
| sgi propack | = 2.4 | No fix listed |
| washington university wu-ftpd | = 2.4.1 | No fix listed |
| washington university wu-ftpd | = 2.4.2_beta2 | No fix listed |
| washington university wu-ftpd | = 2.4.2_beta18 | No fix listed |
| washington university wu-ftpd | = 2.4.2_beta18_vr4 | No fix listed |
| washington university wu-ftpd | = 2.4.2_beta18_vr5 | No fix listed |
| washington university wu-ftpd | = 2.4.2_beta18_vr6 | No fix listed |
| washington university wu-ftpd | = 2.4.2_beta18_vr7 | No fix listed |
| washington university wu-ftpd | = 2.4.2_beta18_vr8 | No fix listed |
| washington university wu-ftpd | = 2.4.2_beta18_vr9 | No fix listed |
| washington university wu-ftpd | = 2.4.2_beta18_vr10 | No fix listed |
| washington university wu-ftpd | = 2.4.2_beta18_vr11 | No fix listed |
| washington university wu-ftpd | = 2.4.2_beta18_vr12 | No fix listed |
| washington university wu-ftpd | = 2.4.2_beta18_vr13 | No fix listed |
| washington university wu-ftpd | = 2.4.2_beta18_vr14 | No fix listed |
| washington university wu-ftpd | = 2.4.2_beta18_vr15 | No fix listed |
| washington university wu-ftpd | = 2.4.2_vr16 | No fix listed |
| washington university wu-ftpd | = 2.4.2_vr17 | No fix listed |
| washington university wu-ftpd | = 2.5.0 | No fix listed |
| washington university wu-ftpd | = 2.6.0 | No fix listed |
| washington university wu-ftpd | = 2.6.1 | No fix listed |
| washington university wu-ftpd | = 2.6.2 | No fix listed |
References
- SSRT4704 vendor-advisory
- 11055 third-party-advisory
- 20168 third-party-advisory
- 102356 vendor-advisory
- DSA-457 patch vendor-advisory
- ADV-2006-1867 third-party-advisory
- RHSA-2004:096 patch vendor-advisory
- 9832 patch vdb-entry vendor-advisory
- wuftpd-restrictedgid-gain-access(15423) vdb-entry
- oval:org.mitre.oval:def:1147 signature vdb-entry
- oval:org.mitre.oval:def:1636 signature vdb-entry
- oval:org.mitre.oval:def:1637 signature vdb-entry
- oval:org.mitre.oval:def:648 signature vdb-entry