Security Information / 1999 / Security Information -- ftpwatch

Debian Security Advisory

ftpwatch -- root compromise in ftpwatch

Date Reported:

17 Jan 1999

Affected Packages:

ftpwatch

Vulnerable:

Yes

Security database references:

In Mitre's CVE dictionary: CVE-1999-0457.

More information:

We have found that the ftpwatch package as distributed in Debian GNU/Linux 1.3 and later distributions has a security problem which makes it trivial for users to gain root access.

We recommend that you remove the ftpwatch package immediately.

We will be working on a new version of ftpwatch to address these issues and will announce that in a new advisory.

A new advisory was never issued. The updated package is available in newer distributions, and its Debian README file contains this:

Due to security problems, FTPWatch no longer installs itself in the
root crontab file. Instead, every user who wants to use it has to place it
in their own crontab. To get a weekly update as before, the following
line could be used:

  47 5    * * 7 /usr/sbin/ftpwatch

This also means that all files in ~/.ftpwatch/ have to be chown'ed to
be owned by the user instead of root.