[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: wu-ftp segfault

Andreas Tille wrote:
> On Wed, 3 May 2000, Bryan Andersen wrote:
> > Check your version number for WU-FTPD.  It should be 2.6.0 or higher.
> ~> dpkg --status wu-ftpd
> Package: wu-ftpd
> Status: install ok installed
> Priority: optional
> Section: net
> Installed-Size: 415
> Maintainer: Chris Butler <chrisb@sandy.force9.co.uk>
> Version: 2.6.0-5
> > A quick jump over to CERT shows you need to have version 2.6.0 of
> > wu-ftpd or latter to avoid the known attacks against it.  Looking at
> > both the frozen and unstable releases we should be up to date.  It may
> > be that there is a new exploit.
> The version should be OK.  How to proceed now?
> There were alltogether 5
>    wu-ftpd[.*]: exiting on signal 11: Segmentation fault
> which occured in a time of 45 minutes.  All connections while this
> time were established from ith2-d69.twcny.rr.com .
> Could it be a potentionally exploit or a bug in wu-ftpd.  I do logcheck
> observations since one month and never detected such things before.

Time to see if there are any signs of a system compromize.

Unfortunatly I'm no expert on that.  If your using tripwire this would
be a good time to check the integrity of system binaries.  If not, 
look for directories like "..." or ".. " or ". ".  Note, programs like 
ls, find, etc may be trojaned so they won't show parts of the root 
kit.  Is there any unusual activity from the machine?  A binary that 
is usually not trojaned is tar.  You can do a 
  "tar xvvf /dev/null > /tmp/l" 
then look thorugh /tmp/l to see if there are any unusual files or 
directories.  Note it is possible for additional modules to be loaded 
into the kernel that modify the file system handling to better hide 
the root kit and the operation of it's payload.

If you do find your system is compromised, wu-ftpd needs to be audited 
to look for more weak spots in it's code.  The fact that you had 
segmentation faults tells me there is likely an exploit for 2.6.0 
wu-ftpd.  It's just not generally known yet.

|  Bryan Andersen   |   bryan@visi.com   |   http://softail.visi.com   |
| Buzzwords are like annoying little flies that deserve to be swatted. |
|   -Bryan Andersen                                                    |

Reply to: