Re: ftpd: the advisory version

[kb8rln () PENGUINMASTER COM (Richard Rager)]

On Mon, 10 Jul 2000, D. J. Bernstein wrote:

> 1. Surely there are other people still wondering about proftpd. Can an
> attacker take over proftpd 1.2.0pre10? CERT seems to say yes, but the
> maintainer says ``relatively minor.'' What's the deal?
   Yes I have had someone get a shell account on my box with proftpd
1.2.0pre10.  I was able to keep him out for a little more with time with
kernel 2.2.16 until the code changed.  This is in the wild!

> 2. I agree that setproctitle() is rather pointless. My comments were
> about all functions with printf()-type format strings. Typical strings
> should fail as format strings.
  Yes

  I was running proftpd in stand alone mode.  The proftpd dies in some of
 these attacts.  It was running as user ftp.

Enjoy,

Richard