Re: Multiple vendors FTP denial of service

[Stefan Laudat <stefan () WORLDBANK RO>]

Hi Aleph,
Please add this to the 'quick fix collection'. Thanks.

> > ftp> ls */../*/../*/../*/../*/../*/../*/../*/../*/../*/../*/../*/../*
> disable globbing symbols with: DenyFilter "[\*\?]" ?

... and as a quick fix for nasty shell users having bash prompts on your machine, just
enter 'set -f' in the /etc/profile. Of course, until we will get a fixed bash or
a fixed libc(?).
For tcsh users set the "noglob" shell variable and kindly RTFM if you have further
questions.
For zsh just use noglob command (man zshmisc).
These disable globbing in some of the most popular shells so your machine is
a bit secure to this attack.

PS. Cisco IOS implementation of flash hierarchical filesystem looks NOT
to be vulnerable, although they implement globbing too.

--
Stefan Laudat
CCNA & CCAI
-------------
There's more than one way to skin a cat:
        Way number 15 -- Krazy Glue and a toothbrush.