WU-FTPD S/KEY Authentication ftpd.c skey_challenge Function Remote Overflow

Critical Nessus Plugin ID 14372


The remote FTP server seems to be vulnerable to a remote buffer overflow.


This version of WU-FTPD contains a remote overflow if s/key support is enabled. The skey_challenge function fails to perform bounds checking on the name variable resulting in a buffer overflow. With a specially crafted request, an attacker can execute arbitrary code resulting in a loss of integrity and/or availability.

It appears that this vulnerability may be exploited prior to authentication.
It is reported that S/Key support is not enabled by default, though some operating system distributions which ship WU-FTPD may have it enabled.

*** Nessus solely relied on the banner of the remote server
*** to issue this warning, so it may be a false positive.


Upgrade to WU-FTPD 2.6.3 when available or disable SKEY or apply the patches available at http://www.wu-ftpd.org

See Also


Plugin Details

Severity: Critical

ID: 14372

File Name: wu_ftpd_skey_remote_buff.nasl

Version: $Revision: 1.19 $

Type: remote

Family: FTP

Published: 2004/08/25

Modified: 2014/05/24

Dependencies: 10079, 10092

Risk Information

Risk Factor: Critical


Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:U/RL:OF/RC:C

Vulnerability Information

Required KB Items: ftp/login, ftp/wuftpd, Settings/ParanoidReport

Exploit Available: false

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 2000/06/07

Reference Information

CVE: CVE-2004-0185

BID: 8893

OSVDB: 2715

DSA: DSA-457-1

RHSA: 2004:096-09