Subject: Re: Patch - Re: Security Issue that prolly should be addressed in some mannor (fwd)

From: Jon Lewis <[email-masked]>
Date: Tue, 9 Feb 1999 00:16:52 -0500 (EST)

Resent cause the list barfed on it the first time

On Mon, 8 Feb 1999, Gregory A Lundberg wrote:

> I placed a low priority on the problem because it had never been seen in
> the wild.  In your misguided zealousness to glean some fame for yourself,

Just because you haven't seen something doesn't mean it's not there.  That
kind of thinking, when applied to security, can be dangerous.

> Now, those of us who maintain FTP servers, not just wu-ftpd, but *ALL*
> servers, must rush about, patching, attempting to limit the damage you
> have caused.  Next time, as I'm quite sure your boss has impressed upon
> you, think before you act.

He's caused no real damage.  When a problem has been known for
considerable time, as appears to be the case here, you should assume there
is exploit code floating around.  Some exploits float about only
occasionally used for quite a while before someone decides to make them
public.

If you want secure file transfers, use scp.

----don't waste your cpu, crack rc5...www.distributed.net team enzo---
 Jon Lewis <[email-masked]>|  Spammers will be winnuked or 
 Network Administrator       |  nestea'd...whatever it takes
 Florida Digital Turnpike    |  to get the job done.
_________http://www.lewis.org/~jlewis/pgp for PGP public key__________