Subject: Re: Bug in mkdir handling (wu-ftpd 2.4.2-academ[beta-11])

From: Will Brown <[email-masked]>
Date: Thu, 26 Sep 1996 18:02:32 -0400 (EDT)

Bob Myers <[email-masked]> said:
> Mkdir handling is wrong on wu-2.4.2-academ[BETA-11] - if there is any
> "upload" configuration entry with "nodirs" on it, no subdirectories
> can be created at all in any location.  No check to see if the upload
> command matches the current directory is made.
> 
> Here is a patch:

I have precisely this configuration installed (Solaris 2.5) and indeed
Bob is correct, even a real user can't mkdir.

But after applying his patch I discovered that the anonymous user
could now mkdir in the upload directory (despite having "nodirs", and
then potentially use that directory as a pass-thru.

I backed out the patch and made sure that the original code did not allow
mkdir in the upload directory (it didn't).

I think this patch does fix the original problem, but it re-opens the
old pass-thru security hole, or a new flavor of it.

Can anyone else corroborate (or dispute) my findings?

--
Will Brown
ZNS, Inc.

---

From: [email-masked] (Bob Myers)
Date: Thu, 26 Sep 1996 16:07:26 -0700

On Sep 26, 18:02, Will Brown wrote:
} Subject: Re: Bug in mkdir handling (wu-ftpd 2.4.2-academ[beta-11])
>-- End of excerpt from Will Brown

You're right.  The problem is a bit of code that says:

> /* CERT suggested fix (change && to || ) */
>    if ( (!strcmp(ARG0, pw->pw_dir))  ||
>		   ((i = path_compare(ARG1, cwdir)) >= match_value) ) {
>          match_value = i;
 
which short-circuits the if clause and "i" is never set, so the match_value
never records a match.

I note the following from FIXES-2.4.2-BETA-9:

> The "nodirs" option of the upload directive in an ftpaccess file is now
> fixed and actually works. Previously, it did not work. Bug reported by CERT.

Was this && to || change a result of this?  I don't know what actually
changed in the code for BETA-9.  It appears to me that this is the wrong
way to fix this problem, and the correct way is to put that back to &&
and actually do the match_value checking per my patch.

What was going on here?  Why was this changed?

-- 
Bob Myers                              InteleNet Communications, Inc.
Email: [email-masked]               30 Executive Park, Suite 150
Phone: 714-851-8250 x227               Irvine, CA 92614
Fax:   714-851-1088                    http://www.intelenet.net/

---

From: Will Brown <[email-masked]>
Date: Mon, 30 Sep 1996 10:31:13 -0400 (EDT)

I found that reversing the CERT "advice" to change && to || as well
as applying Bob Myers patch solved the problem. This did not open
any obvious security holes, but perhaps it opens a non-obvious one.

Bob Myers patch, without reversing the CERT advised change, clearly
allows mkdir in "upload" directories under at least one configuration.

The question is whether CERT's "advice" was based on someone's very
careful analysis, or someone's stab in the dark. I personally have not
looked closely enough at this code to say anything more.

--
Will Brown
ZNS, Inc.

> I'm using FreeBSD 2.1.5 with beta 11 and i do get the problem.
> While i only had entries in ftpaccess to allow directories, it 
> worked, but as soon as i put a nodirs entry in, nobody could create 
> directories.
> Have tried putting all dirs entries first and nodirs second and vice 
> versa with no luck. As soon as there is a nodirs flag in the file, no 
> one can create directories. Still looking for a workaround ...
> 
> Regards, Craig Stratton, NetTec plc.