Subject: Re: ftp(1) security hole, and suggested fixes
To: None <lm@rmit.edu.au>
From: Darren Reed <darrenr@cyber.com.au>
List: tech-security
Date: 08/18/1997 11:46:28
hmmm, come to think of it, I've used "mget .???*" to transfer all my dot-files
from one account to another...I don't think doing "mget ../*" should retrieve
.* files, so maybe screen against them there...
what about a nasty ftp server that sends back an obligitory .rhosts file to
../../../../../../.rhosts ? i.e. it responds to an mget with that in the
list (maybe that's streching it too far...). Anyone for adding in a chroot()
to `pwd` for ftp when receiving files as root ? ;)
neither should mget retrieve things to shells, IMHO, and to do so should
require it to be like:
get README.TXT "|more"
Darren