Subject: Re: CERT Advisory CA-97.27 - FTP_bounce

From: Alain Magloire <[email-masked]>
Date: Tue, 16 Dec 1997 11:13:57 -0500 (EST)

# 
# Are we covered with beta13 for this CERT? CERT Advisory CA-97.27 -
# FTP_bounce
# 

Yes, the "fix" for this was introduce very early in the betas.
It was done by "Hobbit".

beta-{15,14,13,12,11,10,9,8} have the "fix"
and maybe even earlier beta versions.

See FIXES-2.4-HOBBIT for a good discussion on the behaviour of
wu-ftpd concerning PORT.

The "fix" doesn't cover the PASV deficientcies.

I must point out that this is not a "bug" in wu-ftpd. The FTP RFC
allowed this behaviour to permits some sort of proxy ftp.
Now the use of this behaviour to SPAM/SCAN is unfortunate.
But that does not allow root on the server.

I am kind of perplex to see CERT reacted 3 years to late, with a 
useless advisory. Althought it has the nice side effects
of forcing sys. adm. to upgrade there old wu-ftpd and
at the same time "FIX" some real bugs :-).

-- 
au revoir, alain
----
Aussi haut que l'on soit assis, on n'est toujours assis que sur son cul !!!