Re: compress(vul) + ftpd(?)

[Pavel Kankovsky <peak () argo troja mff cuni cz>]

On Sat, 9 Mar 2002, H D Moore wrote:

> ftp> mkdir A<254 * 0x90>
> ftp> cd A*
[...]
> ftp> put <reallysmallscode>
> ftp> cd ../../../../
> ftp> get A*/B*/C*/D*/reallysmallscode.Z

Afaik this won't work because glob() does not expand the path unless a file
matching the *complete* pattern exists. But if x.Z exists, "get x.Z" will
not run compress. Fortunately, we do not get Catch 22 because there is a
nice race condition there. To make things better, wu-ftpd appears to
compute all filenames matching a pattern during wildcard expansion and
drops everything but the first entry of the list afterwards, ie. it is
possible to make the delay much longer and easier to exploit.

> > BTW: This is an ANCIENT problem.
> You would think it would have been fixed by now ;)

Oh really? ;)

--Pavel Kankovsky aka Peak  [ Boycott Microsoft--http://www.vcnet.com/bms ]
"Resistance is futile. Open your source code and prepare for assimilation."