Subject: Dangers of WWW and FTP on same machine

From: Forrest Aldrich <[email-masked]>
Date: Wed, 31 Dec 1997 10:24:55 -0500

Some time ago, I recall reading about some forms of attacks which were made
vulnerable while running a web server and ftpd on the same machine.  I
can't find reference to this anymore and wonder if someone can shed some
light on this issue.

Thanks,

Forrest

---

From: [email-masked]
Date: Wed, 31 Dec 1997 13:43:52 -0500

>From: Albert Lunde<[email-masked]>
...
>The most obvious risk is if you allow use of a type mapping like .cgi to
>designate CGI scripts; if someone can upload a file ...

Also with some configurations the attacker can upload a .htaccess file
to, in effect, grant himself permission to run arbitrary programs. See
http://www.apache.org/docs/misc/security_tips.html for information on
how to block this on some types of web servers. Also, a path-filter
line in your ftpaccess file might be used to block uploading .htaccess
files or other filenames with special meaning to the web server.

Matt

---

From: Michael Douglass <[email-masked]>
Date: Wed, 31 Dec 1997 12:53:51 -0600

> files or other filenames with special meaning to the web server.

I hate to intrude here, but the discussion going on here has absolutely
nothing to do with an FTP server running with a WEB server...  They
very well could be shell accounts doing these 'exploits' being mentioned.

Besides that fact, how in the hell do you expect people to be able to
update their pages without some type of file access to their directories?
I'm confused here.

BUT, if there is an issue about running and FTPd and a web server on
the same machine I'd like to know.  But these have nothing to do with
running the two together on the same machine--hell, I could NFS mount
the web directories, run the ftpd on another machine and these 'exploits'
are available.

Thanks, and have a happy new year,

-- 
Michael Douglass
Texas Networking, Inc.

<tnet admin> anyway, I'm off, perl code is making me [a] crosseyed toady

---

From: "Chris J. Magnuson" <[email-masked]>
Date: Wed, 31 Dec 1997 12:30:07 -0700

>update their pages without some type of file access to their directories?

Um, NFS?

Chris

---

From: Michael Douglass <[email-masked]>
Date: Wed, 31 Dec 1997 13:49:06 -0600

> >update their pages without some type of file access to their directories?

You obviously did not finish reading the email.  As I stated, these
'exploits' have absolutely NOTHING to do with running a FTP server
and a web server on the same machine.  They have everything to do
with people creating files in their web space--which if they can't
do that then what's the purpose of web space.

One last time: These exploits have zilch to do with running an FTP
and a web server on the same machine.

(And for the records, I believe I stated in the email that you could
use NFS.)

-- 
Michael Douglass
Texas Networking, Inc.

---

From: Mark Galbraith <[email-masked]>
Date: 31 Dec 1997 13:07:54 -0800

>>>>> "Chris" == Chris J Magnuson <[email-masked]> writes:

>> update their pages without some type of file access to their directories?

Chris> Um, NFS?

Um, how does this fix the problem?

-- 
Mark Galbraith			     CCI/Triad Corporation, Livermore, CA
Network Manager, UNIX Guru, Webmaster, Postmaster, ...
PGP Fingerprint = 1CB9 7481 AD5C 5709  690B AC09 7F65 D6F6
-- You don't have to be crazy to work on networks...but it sure helps! --