The remote Wu-FTPd server seems to be vulnerable to a remote flaw. This version fails to properly check bounds on a pathname when Wu-Ftpd is compiled with MAIL_ADMIN enabled resulting in a buffer overflow. With a specially crafted request, an attacker can possibly execute arbitrary code as the user Wu-Ftpd runs as (usually root) resulting in a loss of integrity, and/or availability. It should be noted that this vulnerability is not present within the default installation of Wu-Ftpd. The server must be configured using the 'MAIL_ADMIN' option to notify an administrator when a file has been uploaded. *** OVS solely relied on the banner of the remote server *** to issue this warning, so it may be a false positive.
Upgrade to Wu-FTPd 2.6.3 when available
- Null FTP Server SITE Command Execution Vulnerability
- httpdx Multiple Commands Remote Buffer Overflow Vulnerabilities
- WS FTP server FTP bounce attack and PASV connection hijacking flaw
- FTPGetter 'PASV' Command Remote Stack Buffer Overflow Vulnerability
- FTPDMIN 'RNFR' Command Buffer Overflow Vulnerability