Subject: Re: Managing large numbers of guest users

From: "Craig Shrimpton" <[email-masked]>
Date: Sun, 6 Dec 1998 15:21:36 -0500

In terms of security are they equivalent?  I got cracked on wu-ftpd 2.1 and
I'm wicked paranoid now.

-Craig

>
>For most people, the base beta-18 is still the best choice.
>
>If you need some of the more commonly requested features (like those I
>talked about yesterday), VR is for you.
>
>If you have a need for strong virtual hosting as well, go with BeroFTPD.
>

---

From: Bernhard Rosenkraenzer <[email-masked]>
Date: Sun, 6 Dec 1998 22:02:45 +0100 (CET)

> In terms of security are they equivalent?  I got cracked on wu-ftpd 2.1 and

No. Both VR and BeroFTPD are actually more secure than the base beta-18,
which has a buffer overflow-type bug in its realpath() function.
I have not seen an exploit for this bug yet, but it's there, and it's
reproducable.

LLaP
bero

-- 
Windows 98 supports real multitasking - it can boot and crash simultaneously.
***
Anyone sending unwanted advertising e-mail to this address will be charged
$25 for network traffic and computing time. By extracting my address from
this message or its header, you agree to these terms.

---

From: Dave Wreski <[email-masked]>
Date: Sun, 6 Dec 1998 16:24:14 -0500 (EST)

> I have not seen an exploit for this bug yet, but it's there, and it's

Does the fact that there is a bug, which hasn't been exploited, in one
software program automatically make another software program more secure,
overall?

I would think the maintainers of wu-ftpd would be made aware of this, and
a fix be issued?

Dave

---

From: Bernhard Rosenkraenzer <[email-masked]>
Date: Sun, 6 Dec 1998 22:52:14 +0100 (CET)

> software program automatically make another software program more secure,

In this particular case, yes, because the code base is the same in all
three programs we're talking about.
The other versions didn't change much affecting security (BeroFTPD added
the option to have different passwd/shadow files for virtual hosts as well
as PAM support, both of which MIGHT introduce new security problems, but
can be turned off at compile time if you don't trust them), but fixed the
realpath() issue.

> I would think the maintainers of wu-ftpd would be made aware of this,

They are. It has been mentioned several times on this list.

> and a fix be issued?

One of the biggest problems with the "official" wu-ftpd is that new
releases are made VERY rarely. (Just look at the number of postings in
this list asking if there was any development at all.)

Even though a fix has been available for months (it is included in both VR
and BeroFTPD; anyone could simply copy the new realpath() function and
copy it back to the base version), nobody seems to do something about it.
Just another reason to say the inofficial versions are more secure.

LLaP
bero

---

From: Gregory A Lundberg <[email-masked]>
Date: Sun, 6 Dec 1998 23:30:28 -0500 (EST)

On Sun, 6 Dec 1998, Craig Shrimpton wrote:

> In terms of security are they equivalent?  I got cracked on wu-ftpd
> 2.1 and I'm wicked paranoid now.
> >

In increasing security, 2.4 (should never be used), 2.4.2 (beta 18), VR11,
BeroFTPD.  It's a toss up between VR11 and BeroFTP depending on how many
of my fixes Bernard has put in.  I rank Bero higher because of its
superior virtual hosting.

-- 

Gregory A Lundberg		Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195