At 07:32 AM 12/3/01 -0600, Mary Ayala wrote:
> Anyone familiar with this vulnerability? Are the patches finally ready? Do
> I even need to worry?
1: I know enough about it to come to my conclusions.
2: RedHat has since released some updated RPMs for wu-ftpd. I would guess
that these are patched against the most recent bugs. (If RedHat finally
got around to it, I'd guess everyone else has, too. ;)
3: Yes, I'd worry. Two of my machines got rooted last year due to
wu-ftpd's poor track record for remote root exploits. When I heard about
this one, I was running a copy (of last year's patch) on one of my
servers, rather secured by tcpwrappers. I shut it down then and there. I
hereby refuse to run this daemon. I don't especially need an FTP
server. There isn't much that can't be done with HTTP (network
installs) or SCP (general file transfer). If I need an FTP daemon, I'll
start using something more secure, like proftpd.
Yeah, maybe I'm blowing things out of proportion. Once bitten, twice
shy, I guess.
Jima