CVS commit: [netbsd-9] src/usr.bin/ftp

["Martin Husemann" <martin%netbsd.org@localhost>]

Module Name:    src
Committed By:   martin
Date:           Sun Oct 24 10:16:05 UTC 2021

Modified Files:
        src/usr.bin/ftp [netbsd-9]: ftp.c

Log Message:
Pull up following revision(s) (requested by lukem in ticket #1366):

        usr.bin/ftp/ftp.c: revision 1.173

ftp: validate address from PASV and LPSV response

Fail if the server's response to PASV or LPSV contains an IP address
that doesn't match that of the control connection.
(EPSV already only uses the port portion of the server's response,
per RFC 2428).

Previously a hostile server could cause ftp to open a data connection elsewhere.
Many other ftp implementations have had a similar change for many years,
including those in popular browsers (before they deprecated FTP ...)

Thanks to Simon Josefsson notifying me about
  https://lists.gnu.org/archive/html/bug-inetutils/2021-06/msg00002.html


To generate a diff of this commit:
cvs rdiff -u -r1.168.2.4 -r1.168.2.5 src/usr.bin/ftp/ftp.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.