Description
Multiple signal handler race conditions in lukemftpd (aka tnftpd before 20040810) allow remote authenticated attackers to cause a denial of service or execute arbitrary code.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.0 | lukemftpd | 1.1-1woody2 | DSA-551-1 |
Advisories 1
- DSA-551-1 lukemftpd - incorrect internal variable handling Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://www.vuxml.org/freebsd/c4b025bb-f05d-11d8-9837-000c41e2cdad.html
- tnftpd-gain-access(17020) vdb-entry
- DSA-551 vendor-advisory
- 20040817 Multiple remote vulnerabilities in lukemftpd aka. tnftpd mailing-list