Subject: piece of shit listproc...

From: *Hobbit* <[email-masked]>
Date: Mon, 4 Sep 1995 10:16:46 -0400

Since when is "sigh" a listproc directive?!
=================

From: [email-masked]

We are sorry, but this system sensed the following request which may have been
inadvertently sent to list [email-masked]:

SIGH.

If your posting was intentional, please accept our apologies and resend your
mail message, making sure you do not include anything that may look like a
request in the first line of the body of the actual message. If this was 
indeed a request please resend it to [email-masked]
Your entire message is copied below.
=================

... and now on to the point; I was talking about xferlog ...

Sigh.

If I manage to set my anonymous "password", or identd string, or something
else I might be able to modify, to something containing maybe a newline and
the data I want to jam in, and then run that code against the fairly obvious
race condition it leaves open, I still win.

+         sprintf(msg, "%.24s %d %s %d %s %c %s %c %c %s ftp %d %s\n",
+                 ctime(&curtime),
+                 xfertime,
+                 remotehost,				<-- UNSAFE
+                 byte_count,
+                 namebuf,
+                 (type == TYPE_A) ? 'a' : 'b',
+                 opt_string(options),
+                 xfer_type,
+                 anonymous ? 'a' : 'r',
+                 anonymous ? guestpw : pw->pw_name,	<-- UNSAFE
+                 authenticated,
+                 authenticated ? authuser : "*"	<-- UNSAFE
+             );

And this doesn't even address the syslog bounds-checking problem...

_H*