LMH and KF have reported some vulnerabilities in Rumpus, which can be exploited by malicious, local users to gain escalated privileges and potentially by malicious users to compromise a vulnerable system.

1) The application invokes "ipfw" without an absolute path and has the setuid bit set. This can be exploited to gain "root" privileges by placing a specially crafted "ipfw" binary in the path.

2) Boundary errors within the FTP service can be exploited to cause heap-based buffer overflows and can potentially be exploited to execute arbitrary code via specially crafted packets.

Successful exploitation requires a valid user account.

The vulnerabilities are reported in version 5.1. Other versions may also be affected.

Solution
Update to version 5.1.1 or later.

Provided and/or discovered by
LMH and KF

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://projects.info-pull.com/moab/MOAB-18-01-2007.html

Deep Links
Links available to Secunia VIM customers