Subject: [46] Possible security problem?

From: James Ford <[email-masked]>
Date: Fri, 24 Jun 1994 10:34:27 -0600 (CST)

I am using wu-ftpd-2.4(1) on an AIX v3.2.5 system.  I am having no problems 
with anonymous FTP....however, it seems that "real" users who are not members 
of the group "system" are able to get files owned by *.system with a chmod of 
0640 (-rw-r-----).  Example:

ls -lsa /etc/base*
8 -rw-r-----  1  root   system      6614 Oct 9  1993  /etc/basecust

1.  I created a generic user, member of the groups "others" and "staff"
2.  If I ftp to the server running wu-ftpd, I can get the file /etc/basecust 
    (or any file owned by *.system with a chmod of 0640).
3.  If I ftp to another v3.2.5 system running the standard ftpd, I can not
    get this file.    
4.  If I login as this user I can not edit/copy those files.  The user gets
    the generic "permission denied".
5.  If you change the files to another group (cron, printq, etc) you are not
    able to get these files.

This bothers me.  Someone give me a clue.  Is this happening to other 
systems?  What else should I look for?  Is this a massive config error
on my part?

Thanks in advance.

----------
James Ford - Seebeck Computer Center
             [email-masked], [email-masked]
             The University of Alabama (in Tuscaloosa, Alabama)
             (205) 348-3968     (205) 348-3993 (fax)