Subject: Re: If you use Virtual support in ftpd READ THIS NOW!

From: "Marius Strom" <[email-masked]>
Date: Thu, 6 Nov 1997 21:26:21 -0600

Kent & Mailing List...

I just tried to reproduce the problem on my copy of WU-FTPD 2.4.2-B15.  I am
not running virtual server support, but I made some interesting findings.  I
followed your steps, (guestuser, bad passwd, anonymous, passwd) and logged
in.  I have my ftpaccess file setup for max anon connections = 50 and max
guest connections = -1.  When I did this anonymous login, I was user 1 out
of -1, signifying that it still pulled the maxusers from the first login
attempt.  I am running Solaris 2.5.1, on a Sun Ultra 3000.  Have not yet
made the patches to the ftpd.c files, but these are my findings..  Your
mileage may vary.. =)

Marius Strom - [email-masked]
Network Administrator, Twister Communications
http://www.twistercom.com/~marius
-----Original Message-----
From: Kent Landfield <[email-masked]>
To: [email-masked] <[email-masked]>
Cc: [email-masked] <[email-masked]>
Date: Thursday, November 06, 1997 4:54 PM
Subject: If you use Virtual support in ftpd READ THIS NOW!

>If you are using Virtual Server support in newvirt or beta-15
>READ THIS NOW!
>
>There seems to be a "logic problem" ;) in the virtual code in
>beta15.  It also appears in my version newvirt version of virtual
>server support.  The problem is this...
>
>If someone tries to login with a valid guestuser account and uses
>a bogus password, then they enter a 'user anonymous' and type in
>a random password, the user will be authorized to access the system
>but in the wrong ftp area...  Not nice.
>
>In otherwords the sequence is:
>
>         login: some-valid-guestuser
>      Password: bogus invalid passwd entered
>           ftp> user anonymous
>      Password: valid junk passwd entered
>
>    wrong directory (ftp account's directory)
>
>To correct this,
>
>In the function user() in ftpd.c just after the
>
>    if (logged_in) {                    /* Now a no-op.  _H*/
>        if (anonymous || guest) {
>            reply(530, "Can't change user from guest login.");
>            return;
>        }
>        end_login();
>    }
>
>on line 1089, add
>
>    guest = 0;
>
>and recompile it.
>
>----------- Should end up looking like ----------------
>    if (logged_in) {                    /* Now a no-op.  _H*/
>        if (anonymous || guest) {
>            reply(530, "Can't change user from guest login.");
>            return;
>        }
>        end_login();
>    }
>
>    guest = 0;
>    anonymous = 0;
>    acl_remove();
>-------------------------------------------------------
>
>The guest flag is getting set the first time through the user()
>function and then it is not getting reset if the person fails and
>then switches to an anonymous account.  Then in the pass() function,
>with guest still set, it skips the virtual_mode check since guest
>was set and falls through to a place it should not be...
>
>A new version of newvirt will be put up tonight that fixes this.
>For those that can't take the time to mess with installing new server,
>make the changes above on you current copy and reinstall.
>
>I've Cc:'ed [email-masked] so it's queued to be fixed in the
>next release.
>
>--
>Kent Landfield                        Phone: 1-817-545-2502
>Email: [email-masked]             http://www.landfield.com/
>Email: [email-masked]                   http://www.nfr.net/
>Search the Usenet Hypertext FAQ Archive at http://www.faqs.org/faqs/
>

---

From: Kent Landfield <[email-masked]>
Date: Fri, 7 Nov 1997 00:14:33 -0600 (CST)

# I just tried to reproduce the problem on my copy of WU-FTPD 2.4.2-B15.  I am
# not running virtual server support, but I made some interesting findings.  I
# followed your steps, (guestuser, bad passwd, anonymous, passwd) and logged
# in.  I have my ftpaccess file setup for max anon connections = 50 and max
# guest connections = -1.  When I did this anonymous login, I was user 1 out
# of -1, signifying that it still pulled the maxusers from the first login
# attempt.  I am running Solaris 2.5.1, on a Sun Ultra 3000.  Have not yet
# made the patches to the ftpd.c files, but these are my findings..  Your
# mileage may vary.. =)

Marius, thanks for the heads up. Looks like there is some effect on all 
sites with guestusers.  What's happening is the guest flag is getting set 
the first time through the user() function and then it is not getting reset 
if the person fails and then switches to an anonymous account.  Then in the 
pass() function, with guest still set, it falls through to a place it should 
not be thus confusing things nicely.

I have uploaded a new copy of newvirt (newvirt-040) onto the Resource
Center.  Sites that are running the newvirt-030 or earlier versions might 
want to upgrade to this.  It is Beta-15 with the newvirt code, the recently 
discovered bug fixed, a tweaked ftpck and new manual pages for ftpshut and 
ftprestart. It has been run on Solaris 2.5* and BSDI 3.0. (Perry sent me 
FreeBSD patches and I misplaced them... (Perry, a new copy would be nice. 
(...sorry...)) (The ftpck included has been expanded to support the new 
method of virtual support. Please note: There is no reason to grab 
newvirt-040 just to get a tweaked ftpck unless you need virtual support.)

This is something that we need to get fixed folks.  The instructions on
how to correct this are included below.

---------------------------------------------------------
To correct the guestuser access problem in beta-15...

on line 1089, add

    guest = 0;

and recompile it.

----------- Should end up looking like ----------------

    guest = 0;
    anonymous = 0;
    acl_remove();

I suggest that you make this change.  This is probably something that
needs to go to the bugtraq list.  I am a bit hesitant in doing so until
you have had a chance to correct your servers.  I'll wait a couple days.