The lreply function in wu-ftpd 2.6.0 and earlier does not properly cleanse an untrusted format string, which allows remote attackers to execute arbitrary commands via the SITE EXEC command.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Hp-ux | Hp | 11.00 (including) | 11.00 (including) |