TITLE:  SSRT4704, SSRT4705 - HP Tru64 UNIX - Potential WU-FTPD Security 
                             Vulnerabilities

Copyright (c) Hewlett-Packard Company 2004.  All rights reserved.


PRODUCT:    WU-FTPD V2.6.2(1) for Tru64 UNIX 5.1A and 5.1B 
SOURCE:     Hewlett-Packard Company

ECO INFORMATION:

     ECO Name:  T64V51AB-IX622-WUFTPD262-SSRT4704-SSRT4705.tar
     ECO Kit Approximate Size:  3.8 MB 
     Kit Applies To:  Tru64 5.1A or 5.1B systems on 
                      latest supported base levels. 

     ECO Kit CHECKSUMS:
	/usr/bin/sum results:  
	13931   3860 

	/usr/bin/cksum results: 
	4292765317 3952640 

	
ECO KIT SUMMARY:

A setld-based, Early Release Patch kit exists for WU-FTPD that
contains solutions to the following problem(s):


Two potential security vulnerabilities have been identified in WU-FTPD 
that may be remotely exploitable resulting in unauthorized directory access, 
Denial of Service(DoS), or elevated user privileges. WU-FTPD is 
distributed via the Internet Express(IX) set of products available 
for Tru64 UNIX.

   o SSRT4704, SSRT4705 Internet Express WU-FTPD (Severity - High)

Cross References: CAN-2004-0148, 
                  CAN-2004-0185 

HP has addressed these potential vulnerabilities with this patched 
version of WU-FTPD. 

This patch kit delivers V2.6.2(1) of WU-FTPD 
with the security patches in the form of a setld patch kit.


The Patch Kit Installation Instructions and the Patch Summary and Release
Notes documents provide patch kit installation and removal instructions
and a summary of each patch. Please read these documents prior to 
installing patches on your system.

The patches in this ERP kit will are scheduled to be available in 
the next mainstream Internet Express (IX) release: V6.3.

**********************************
Special Installation Instructions:
**********************************

To install this patch kit:

# su root
# tar xvf  T64V51AB-IX622-WUFTPD262-SSRT4704-SSRT4705.tar
# setld -l . IAEFTP622

To remove this patch kit:

# su root
# setld -d IAEFTP622

To verify installation of the patch kit: 

# su root
# /usr/local/bin/ftpd -V | grep Version
Version wu-2.6.2(1) Mon Apr 5 03:14:53 EDT 2004



INSTALLATION PREREQUISITES:

You must have Tru64 UNIX 5.1B or 5.1A installed with the latest
supported base levels prior to installing this Early Release Patch Kit.

KNOWN PROBLEMS WITH THE PATCH KIT:

None.



[R] UNIX is a registered trademark in the United States and other countries 
licensed exclusively through X/Open Company Limited.

Copyright Hewlett-Packard Company 2004.  All Rights reserved.

  This software is proprietary to and embodies the confidential technology
  of Hewlett-Packard Company.  Possession, use, or copying of this
  software and media is authorized only pursuant to a valid written license
  from Hewlett-Packard or an authorized sublicensor.

       This ECO has not been through an exhaustive field test process.
       Due to the experimental stage of this ECO/workaround, Hewlett-Packard
       makes no representations regarding its use or performance. The
       customer shall have the sole responsibility for adequate protection
       and back-up data used in conjunction with this ECO/workaround.