Subject: RE: FTP Security Draft 12/23/96

From: "Roger A. Hanke" <[email-masked]>
Date: Tue, 7 Jan 1997 09:40:12 -0500

Stan,
 Thanx much for the clarification on these security fixes being in Beta 11.
Speaking of security fixes in Beta 12, any chance of getting the recent
security hole closed in it. The one that David Greenman discussed on
1/2/97 that I copied the following summary
from? It seemed that the fix was fairly small and localized.
I know you had said just fixes and this does seem to qualify...
	Just hoping,
	Roger Hanke

Summary
-------
   There is a serious security bug in wu-ftpd v2.4 (including the
version from Academ) which may allow both regular and anonymous users
to access files as uid 0 (root). The same bug is also responsible for
an advisory lock not being unlocked - potentially resulting in blocked
access to future ftp logins and filling up the process table and swap
space until the server dies.

----------
From: 	Stan Barber
Sent: 	Monday, January 06, 1997 6:16 PM
To: 	[email-masked]
Subject: 	Re: FTP Security Draft 12/23/96

In article <[email-masked]> "Roger A. Hanke" <[email-masked]> writes:
>I hadnt seen any mention in the Beta 5 (or any later release)
>release notes about Hobbit inclusion
>and Beta 5 came out after the Hobbit so I was concerned that 
>the Hobbit patches were not included in the latest Beta 11 version?

Beta 5 and later came with all the Hobbit patches available at that time,
so Beta 11 still contains them, as will Beta-12.

-- 
Stan   | Academ Consulting Services        |internet: [email-masked]
Olan   | For more info on academ, see this |uucp: {mcsun|amdahl}!academ!sob
Barber | URL- http://www.academ.com/academ |Opinions expressed are only mine.