Secunia

Description

Debian has issued updated packages for WU-FTPD. These fix an old vulnerability, which can be exploited by malicious users to execute arbitrary commands on a vulnerable system.

The vulnerability is caused due to an input validation error when FTP conversion is enabled. This can be exploited to execute arbitrary commands via a specially crafted file name, which is interpreted as command line arguments to the conversion program (eg. tar).

Successful exploitation requires that the malicious person has been authenticated by the FTP server.

Solution
Updated packages:
Further details available in Customer Area

Original Advisory
http://www.debian.org/security/2003/dsa-377

Deep Links
Links available in Customer Area