Subject: Re: "upload" broken in wu-ftpd 2.4?

From: Yanming PENG <[email-masked]>
Date: Thu, 14 Sep 95 17:09:27 WETDST

>   I just found out that some hackers are using my site as a drop site.  I'm
> using the following upload keyword to keep that from happening:
> 
> upload  /opt/local/ftp  /incoming         yes     root    staff  0600 dirs
> 
I have asked the question before, no response at all. I will rather call
this a bug rather than a (undocumented) feature. However, I managed to
find out a workaround.

The reason to cause the owner problem is that ~ftp/incoming is public
unreadable. Then, all files and dirs are owned by ftp.bin. Your root.staff
setting does not work as expected. Put back the public read permission
solve the problem.

> I can't seem to break that, but someone else has figured out how.  They've
> created a directory called:
> 
> ./ /^[[I^[[C^[[P/.^F^A^T^E./
> 
Look like your ftpaccess setup problem. By default, wu-ftpd does not allow
space and dot as file name. Are you sure the ftpd does not bypass ftpaccess?

> that contains many other subdirectories with hacked programs.  Is this fixed
> in the latest beta release?  If so, how can I get a copy?
> 
> ...dave alden
> 

--
Yanming PENG
[email-masked]

---

From: Yanming PENG <[email-masked]>
Date: Thu, 14 Sep 95 17:40:29 WETDST

> that contains many other subdirectories with hacked programs.  Is this fixed

On second thought, are you sure it is done via ftp? (check xferlog) It maybe
created by a user directly and chown to ftp. Does your system allow regular
user chown?

--
[email-masked]

---

From: [email-masked] (Ketan Shah)
Date: Thu, 14 Sep 1995 11:44:58 -0400

What is the reason dir wont work?

Thanks in advance.

-- 
Ketan Shah ([email-masked])
	
Varimetrix Corporation
2350 Commerce Pk. Dr., No. 4
Palm Bay, FL 32905
Tel. No.(407)-676-3222