Subject: BUG in wu-2.4.2-academ[BETA-18-VR13

From: Mark Silverman <[email-masked]>
Date: Fri, 12 Feb 1999 15:53:05 -0500 (EST)

I believe I have found a bug in the ftpaccess processing
in BETA-18-VR13.

In access.c, in the function hostmatch(), prior to checking for a
hostname/domain glob match, you need to check for an IP glob
match as follows:

       fclose(incfile);
        return(found);
    }
+    else if (isdigit(*addr))
+    {   /* mls 2-12-99:  Match numeric IP glob */
+        return(!fnmatch(addr, remoteaddr, NULL));
+   }
    else 
 
      {   /* match a hostname or hostname glob */
        char *addrncase,*hostncase;
    
This is how it appeared to work in BETA-15.  

+------------------------------------------+ 
| Mark Silverman                     >     |           
| National Library of Medicine      /|\    |
| Voice: (301) 496-3012            / | \   |
| Fax: (301) 480-1957             /__|__\  |
| [email-masked]               \___|__/  |
|                                          |
|   How can you be in two places at once   |
|   when you're not anywhere at all? (FsT) |
+------------------------------------------+

---

From: Gregory A Lundberg <[email-masked]>
Date: Fri, 12 Feb 1999 16:10:10 -0500 (EST)

On Fri, 12 Feb 1999, Mark Silverman wrote:

> I believe I have found a bug in the ftpaccess processing in
> BETA-18-VR13.
> 
> hostname/domain glob match, you need to check for an IP glob match as
> follows:

That check was taken out because it was matching too many hosts and
presented a security threat.  Consider a host

  127.attacker.example.net [192.168.1.2]

and the ftpaccess clause

  class localuser real 127.*.*.*

the original code, which your patch re-installs, allows the attacker
access to your machine.

I have a patch submitted earlier today from another person who noticed the
change which does not suffer from this problem.  I will be using his patch
in VR15, due out at the beginning of the month.  If you need his patch
sooner, email me and I'll send it along to you; if I get enough requests,
I'll put in in my unsupported area until it goes into VR15.

-- 

Gregory A Lundberg		Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195