Wu-ftpd Remote Root Hole

Ademar writes: "A remote exploitable vulnerability was found in wu_ftp, which is distributed in all major distros. The CERT has a (private) list to coordinate this kind of disclosure so vendors can release updates together, but RH broke the schedule and released their advisory first. You can see the full advisory from securityfocus in bugtraq, but here is a quote: "This vulnerability was initially scheduled for public release on December 3, 2001. Red Hat pre-emptively released an advisory on November 27, 2001. As a result, other vendors may not yet have fixes available."" CNET has a story about this too.

Comments

So what's wrong with that?

[shoemakc]

Further hipocracy on slashdot....

./ blasts MS whenever they try to keep a known exploit quiet for whatever reason, but then goes ahead and blasts Redhat for spilling the beans.

I thought the whole point of OS was so that you can make changes/fixes yourself? I'd rather go a week without a distro patch, then not know about the exploit at all. At least then i can disable the daemon, or impliment a kludge fix.

-Chris

Re:No surprises here

[augustz]

Couldn't agree more, the distros need to stop shipping software with horrendous security records.

wu-ftpd/bind/sendmail literally give me the shudders. There are solid competitors for all of these. Greater or equal features, and designs that are much more secure.