Description
Off-by-one error in the fb_realpath() function, as derived from the realpath function in BSD, may allow attackers to execute arbitrary code, as demonstrated in wu-ftpd 2.5.0 through 2.6.2 via commands that cause pathnames of length MAXPATHLEN+1 to trigger a buffer overflow, including (1) STOR, (2) RETR, (3) APPE, (4) DELE, (5) MKD, (6) RMD, (7) STOU, or (8) RNTO.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.0 | wu-ftpd | 2.6.2-3woody1 | DSA-357 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 5
- WU-FTPD 2.6.2 - Remote Command Execution EDB-78 · remote · Aug 11, 2003 · verified
- WU-FTPD 2.6.0/2.6.1/2.6.2 - 'realpath()' Off-by-One Buffer Overflow EDB-22975 · remote · Aug 6, 2003 · verified
- WU-FTPD 2.6.2 - Off-by-One Remote Command Execution EDB-74 · remote · Aug 3, 2003 · verified
- WU-FTPD 2.6.2 - 'realpath()' Off-by-One Buffer Overflow EDB-22974 · remote · Aug 2, 2003 · verified
- FreeBSD 4.8 - 'realpath()' Off-by-One Buffer Overflow EDB-22976 · remote · Jul 31, 2003 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 1
- DSA-357 wu-ftpd - remote root exploit Debian Security (DSA / DLA) · Mar 9, 2026
References
- 20030804 Off-by-one Buffer Overflow Vulnerability in BSD libc realpath(3) mailing-list
- http://isec.pl/vulnerabilities/isec-0011-wu-ftpd.txt
- 9446 third-party-advisory
- 6602 vdb-entry
- oval:org.mitre.oval:def:1970 vdb-entry signature
- 20060213 Latest wu-ftpd exploit :-s mailing-list
- 8315 vdb-entry
- 9423 third-party-advisory
- 20030731 wu-ftpd fb_realpath() off-by-one bug mailing-list
- 20030731 wu-ftpd fb_realpath() off-by-one bug mailing-list
- IMNX-2003-7+-019-01 vendor-advisory
- RHSA-2003:246 vendor-advisory
- 20060214 Re: Latest wu-ftpd exploit :-s mailing-list
- VU#743092 third-party-advisory
- RHSA-2003:245 vendor-advisory
- SuSE-SA:2003:032 vendor-advisory
- 1001257 vendor-advisory
- DSA-357 vendor-advisory
- 20030804 wu-ftpd-2.6.2 off-by-one remote exploit. mailing-list
- 1007380 vdb-entry
- MDKSA-2003:080 vendor-advisory
- libc-realpath-offbyone-bo(12785) vdb-entry
- FreeBSD-SA-03:08 vendor-advisory
- TLSA-2003-46 vendor-advisory
- 9535 third-party-advisory
- 9447 third-party-advisory