National Vulnerability Database (CVE-2001-0187)

National Cyber-Alert System Vulnerability Summary: CVE-2001-0187
Orirignal release date: 2001-03-26 Source: US-CERT/NIST ### Overview Format string vulnerability in wu-ftp 2.6.1 and earlier, when running with debug mode enabled, allows remote attackers to execute arbitrary commands via a malformed argument that is recorded in a PASV port assignment. ### Impact CVSS Severity: 10 (High) Range: remote Authentication: exception,env Impact Type: sec_prot admin="1" ### Reference to Advisories, Solutions, and Tools External Source: Security Focus Name: bid 2296 Hyperlink: http://www.securityfocus.com/bid/2296 External Source: ISS X-Force Name: wuftp-debug-format-string(6020) Hyperlink: http://xforce.iss.net/static/6020.php External Source: Debian Name: DSA-016-3 wu-ftpd: temp file creation and format string Hyperlink: http://www.debian.org/security/2001/dsa-016 External Source: CONFIRM Name: ftp://ftp.wu-ftpd.org/pub/wu-ftpd/patches/apply_to_current/missing_format_strings.patch Hyperlink: ftp://ftp.wu-ftpd.org/pub/wu-ftpd/patches/apply_to_current/missing_format_strings.patch ### Vulnerable Software and Vendor wu-ftpd (University of Washington) Technical Details CVE Standard Vulnerability Entry: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0187