CVE-2000-0574: Medium severity Washington University Wu-ftpd vulnerability

Published Jul 7, 2000

Updated

FTP servers such as OpenBSD ftpd, NetBSD ftpd, ProFTPd and Opieftpd do not properly cleanse untrusted format strings that are used in the setproctitle function (sometimes called by setproctitle), which allows remote attackers to cause a denial of service or execute arbitrary commands.

Affected Software

20 affected components

Washington University Wu-ftpd=2.4.2_beta18

Washington University Wu-ftpd=2.4.2_beta18_vr14

Washington University Wu-ftpd=2.4.2_vr17

Washington University Wu-ftpd=2.4.2_beta18_vr9

Washington University Wu-ftpd=2.5

Washington University Wu-ftpd=2.4.2_vr16

Washington University Wu-ftpd=2.4.2_beta18_vr11

Washington University Wu-ftpd=2.4.2_beta18_vr6

Washington University Wu-ftpd=2.4.2_beta1

OpenBSD ftpd=5.51

Washington University Wu-ftpd=2.4.2_beta18_vr4

Washington University Wu-ftpd=2.6

Washington University Wu-ftpd=2.4.2_beta18_vr12

Washington University Wu-ftpd=2.4.2_beta18_vr5

Washington University Wu-ftpd=2.4.2_beta18_vr13

Washington University Wu-ftpd=2.4.2_beta18_vr10

Washington University Wu-ftpd=2.4.2_beta18_vr15

Washington University Wu-ftpd=2.4.2_beta18_vr7

OpenBSD ftpd=5.60

Washington University Wu-ftpd=2.4.2_beta18_vr8

Remediation

Patch Available

http://www.cert.org/advisories/CA-2000-13.html

Event History

Jul 7, 2000

CVE Published

04:00 AM

Jul 19, 2000

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2000-0574?

CVE-2000-0574 is considered a high severity vulnerability due to its potential to allow remote attackers to execute arbitrary commands or cause a denial of service.

How do I fix CVE-2000-0574?

To fix CVE-2000-0574, update affected FTP server software to a version that has addressed this vulnerability.

Which software is affected by CVE-2000-0574?

CVE-2000-0574 affects FTP servers such as OpenBSD ftpd, NetBSD ftpd, ProFTPd, and various versions of wu-ftpd.

What kind of attacks can CVE-2000-0574 enable?

CVE-2000-0574 can enable remote attackers to execute arbitrary commands or initiate a denial of service attack.

Is there a workaround for CVE-2000-0574?

While the best solution is to update the affected software, restricting access to the FTP server can serve as a temporary workaround for CVE-2000-0574.