___________________________________________________________________________

	    Caldera International, Inc. Security Advisory

Subject:		OpenServer: wu-ftpd ftpglob() vulnerability
Advisory number: 	CSSA-2002-SCO.1
Issue date: 		2002 January 10
Cross reference:
___________________________________________________________________________


1. Problem Description
	
	A vulnerability in the wu-ftpd ftpglob() function was found by
	the CORE ST team.  This vulnerability can be exploited to
	obtain root access on the ftp server.


2. Vulnerable Versions

	Operating System	Version		Affected Files
	------------------------------------------------------------------
	OpenServer		<= 5.0.6a	/etc/ftpd


3. Workaround

	None.


4. OpenServer

  4.1 Location of Fixed Binaries

	ftp://stage.caldera.com/pub/security/openserver/CSSA-2002-SCO.1/


  4.2 Verification

	MD5 (erg711907.tar) = 577a93a058d37283037be476b9e54298


	md5 is available for download from

		ftp://stage.caldera.com/pub/security/tools/


  4.3 Installing Fixed Binaries

	Upgrade the affected binaries with the following commands:

	Download erg711907.tar to /tmp

	# cd /tmp
	# tar xvf erg711907.tar
	# custom

	Instruct custom to install from images, and supply /tmp as the
	directory of the VOL images.
	       

5. References

	CORE-20011001: Wu-FTP glob heap corruption vulnerability
	http://www.corest.com

	CERT Advisory CA-2001-33 Multiple Vulnerabilities in WU-FTPD
	http://www.cert.org	

	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0550

	This and other advisories are located at
		http://stage.caldera.com/support/security

	This advisory addresses Caldera Security internal incidents
	sr856022, SCO-559-1331, erg711907.


6. Disclaimer

	Caldera International, Inc. is not responsible for the misuse
	of any of the information we provide on our website and/or
	through our security advisories. Our advisories are a service
	to our customers intended to promote secure installation and
	use of Caldera International products.


7. Acknowledgements

	This vulnerability was originally reported by Matt Power of
	BindView on the vuln-dev mailing list.

	 
___________________________________________________________________________