wu-ftpd 2.6.1 allows remote attackers to execute arbitrary commands via a "~{" argument to commands such as CWD, which is not properly handled by the glob function (ftpglob).

CORE ST reports that an exploit has been found for a bug in the  wu-ftpd glob code (this is the code that handles filename wildcard  expansion). Any logged in user (including anonymous FTP users) can  exploit the bug to gain root privileges on the server.

A vulnerability in wu-ftpd's ftpglob() function was found by the CORE ST team. This vulnerability can be exploited to obtain root access on the FTP server.

The FTPD glob vulnerability manifests itself in handling the glob command. The problem is not a typical buffer overflow or format string vulnerability, but a combination of two bugs - an implementation of the glob command that does not properly return an error condition when interpreting the string 'bracket', and then frees memory which may contain user-supplied data.

An attacker who is able to log in to a vulnerable server, including users with anonymous access, can exploit this to execute arbitrary code with the privileges of the FTP service.

ID	Name	Product	Family	Severity
14924	Debian DSA-087-1 : wu-ftpd - remote root exploit	Nessus	Debian Local Security Checks	high
13903	Mandrake Linux Security Advisory : wu-ftpd (MDKSA-2001:090)	Nessus	Mandriva Local Security Checks	high
10821	Multiple FTPD glob Command Arbitrary Command Execution	Nessus	FTP	critical

Detections

Analytics

CVE-2001-0550

critical

Tenable Plugins

high

high

critical