New security hole found in FTP
The problem, according to PGP Security, is caused by a flaw in the technology that many FTP servers use to handle searches for files. This flaw can allow an attacker to take full control of the vulnerable system. Once an attacker has taken control, he can do anything on the system that the system administrator can do, including reading, replacing or deleting data, and altering the contents of websites. He can also replace downloadable files with malicious files containing viruses or other malevolent programs. The affected server can also be used as a base to launch denial of service attacks, or to break into other machines on the network. Systems affected by this include commercial Unix and BSD-based File Transfer Protocol (FTP) server distributions, including FreeBSD 4.2, NetBSD 1.5, OpenBSD 2.8, HPUX 11, IRIX 6.5 and Solaris 8. For more on this, check out the CERT Advisory.
