Subject: FTPD issue

From: [email-masked] (Greg Smith)
Date: Wed, 28 Aug 1996 13:58:40 -0400 (EDT)

I just pulled down wu-ftpd-2.4.2-beta-11 from your ftp site.
I was wondering if the following problem that I read about is
fixed in this beta pass.  If so, could someone provide specific information
about this fix.

Most serious, and this problem exists in virtually ALL FTP servers, is the
ability for an anonymous user to make the server connect to an arbitrary port
on an arbitrary machine and pass data in one direction or the other.  This
allows a whole variety of annoyance and denial-of-service attacks, and in some
cases could allow unintended access to other machines.  Selection of data
ports has therefore been restricted in this version.

Thanks very much,
Greg
[email-masked]

---

From: Alain Magloire <[email-masked]>
Date: Thu, 29 Aug 1996 11:30:11 -0400 (EDT)

> ports has therefore been restricted in this version.

lot of noise lately on the subject. IMHO it is not a problem and
part of the implementation of FTP as descibed in rfc959.

Any ftpd who "truly" implements rfc959 should have this. It permits
proxy transferts. Interestingly Solaris-2.5 Ftpd will restrict this.

(From a glimpse at the code)
The fix in 2.4.2-beta-11 will refused PORT command if
the port is < 1024 and if the IP is different from the client.

--
alain