Re: Security Problem ftpd (includes wu.ftpd 2.4 and 2.4.2 beta 4)

[casper () Holland Sun COM (Casper Dik)]

> Am I correct in stating that this problem only occurs on SVR4 based unix's
> [where /proc exists]?  Or would, say, SunOS 4.1.x be affected?


It does not occur on SVR4 based Unixes.  It occurs only on Linux /pro
implementation.

The SVR4 /proc implemntations only have one file for each process
in /proc.  You're not allowed to access that file unless you're root
or your privs are a superset of that process' privs.

Since ftpd runs with a real-uid of root, you cannot access the /proc
entry of your own ftpd.

Casper