Subject: "upload" broken in wu-ftpd 2.4?

From: Dave Alden <[email-masked]>
Date: Thu, 14 Sep 1995 10:11:53 -0400 (EDT)

Hi,
  I just found out that some hackers are using my site as a drop site.  I'm
using the following upload keyword to keep that from happening:

upload  /opt/local/ftp  /incoming         yes     root    staff  0600 dirs

I can't seem to break that, but someone else has figured out how.  They've
created a directory called:

./ /^[[I^[[C^[[P/.^F^A^T^E./

that contains many other subdirectories with hacked programs.  Is this fixed
in the latest beta release?  If so, how can I get a copy?

...dave alden

ps  I tried to search through the archives to see if this was already covered,
    but as far as I can tell (I don't have a degree in "How To Use Listproc"),
    there aren't any archives.

---

From: Michael Brennen <[email-masked]>
Date: Thu, 14 Sep 1995 10:44:14 -0500 (CDT)

> in the latest beta release?  If so, how can I get a copy?

The URL is ftp://ftp.academ.com/pub/wu-ftpd/private/wu-ftpd-2.4.2-beta-5.tar.Z

Set the /etc/ftpaccess options to something like this:

path-filter  anonymous  /etc/pathmsg  ^[-A-Za-z0-9_\.]*$  ^\.  ^-

     Prevents weird file names.

upload  /opt/local/ftp  /incoming         yes     root    staff  0600 dirs
                                                                      nodirs
     Prevents directories from being created.                         ^^^^^^

Check out Christopher Klaus's Secure FTP FAQ:

http://iss.net/iss/faq.html

Also, I have permissions set to 0733 on the incoming directory; no one can
see the contents, and you cannot read from the directory.  I don't care if
it is inconvenient.  The incoming directory is incoming *only* -- no
trading here, please. 

Michael Brennen

---

From: Dave Alden <[email-masked]>
Date: Thu, 14 Sep 1995 12:28:46 -0400 (EDT)

Hi,

> path-filter  anonymous  /etc/pathmsg  ^[-A-Za-z0-9_\.]*$  ^\.  ^-

They already are.  :-(

>      Prevents directories from being created.                         ^^^^^^

But it shouldn't matter, right?  Once the directory is created, it is supposed
to be chown'ed to root with a protection of 600 -- but it isn't being done.
After the directory is created, ftp owns it.

> http://iss.net/iss/faq.html

Thanks.

> it is inconvenient.  The incoming directory is incoming *only* -- no

But being able to see the contents shouldn't matter if ftpd properly chown's
and chmod's the file (which it does on files, but doesn't seem to do on the
directories).

...dave