Subject: Re: BUG??? WU!

From: Kent Landfield <[email-masked]>
Date: Thu, 20 Nov 1997 00:46:40 -0600 (CST)

# He's an X customer...as soon as I know how to really keep him out. He got
# access to 12 or more servers and I just need to be sure before I anger him.

I can understand that. ;) Is there are real need for him to access that 
set of systems ?  I'd slowly wall off those facilities he has no need to
access and call it a policy change... or a site re-configuration...

# He won't answer straight questions. His English isn't so good...then he
# goes Hehehehehe and it really pisses me off.

It's nice that you are trying to work this out by understanding things
but what he is doing could be quite illegal.  If I was you, while you're
trying to understand the means, document what he is doing and try to
get some proof it is him (such as someone else witnessing him agreeing
it is him).  Hard proof that will stand up in court can be difficult to
obtain but witness testimony is quite useful. (For what it's worth...)

# >   - Does he have simply an ftp account or does he also have telnet access ?
# >
# FTP and telnet.

Hmmm.  I'll bet that he has found a loophole in the interactive setup.  (In 
otherwords a hole on your system that he must have telnet access to exploit.)

Any chance of limiting him to just ftp ?

# >   - Is he using gnutar at any point ?
# >
# He could use tar (which is GNU I believe), why? Is there a problem with tar?

This is an oldy but a baddy and is for everyone to pay attention to.
-------------------------------
  Alan Cox ([email-masked]) 
  Mon, 19 Aug 1996 14:09:19 +0100 
  Subject: WU.FTPD vulnerability: gnu tar possibly others

   quote site exec tar  -c -v --rsh-command=commandtorunasftp -f somebox:foo foo
 
  Gnu tar allows you to specify which binary you wish to run.
 
  Fix:
        Use a dumber tar. Also carefully evaluate any other binaries
  you have to avoid unpleasant and similar suprises.

  Better Fix:
      Disable site exec. You can give the tar benefits without site exec. See
  ftpconversions, if I'm not mistaken...

  or have no binaries in the _PATH_EXECPATH.
-------------------------------

# >Start up your server in the inetd.conf file with a "in.ftpd -la" so you can
# >get more info.
# >
# OK. Good. I'll do it. Why the [in.]ftpd? my ftpd is just
# /usr/local/libexec/ftpd, is this correct?

Oh, sorry. That is simply my configuration.  The key there is the '-la'.

# PS - These are the first straight answers I've gotten...

Hey, if there is a bug in wu-ftpd that he is getting in through at your site,
chances are there are others of us vunerable to that type of attack.  The
key here is to make sure he is not coming through wu-ftpd.  I don't mind
helping with any type of attack but especially a wu-ftpd one. ;)

Oh... Just a thought... ;) Do you have a copy of tcpdump handy ? :) A little
session watching might just be in order. :)

-- 
Kent Landfield                        Phone: 1-817-545-2502             
Email: [email-masked]             http://www.landfield.com/
Email: [email-masked]                   http://www.nfr.net/
Please send comp.sources.misc related mail to [email-masked]
Search the Usenet Hypertext FAQ Archive at http://www.faqs.org/faqs/