Subject: wu-ftpd 2.5.0 and SunOS 4.1.3

From: "Christopher X. Candreva" <[email-masked]>
Date: Mon, 30 Aug 1999 14:18:24 -0400 (EDT)

I'm attempting to upgrade in response to the recent announcements about
holes in older versions.  Is the answer for those of us running 4.1.3
basicly that we are SOL ?

The problem: I've gotten it to compile, but I can't 'get' any files.
Apparently, it's looking for files in whatever dirrectory ls is run from.

I've checked through the the mailing list archive and the FAQ, and found no
mention of this. If it has been brought up I will happily take a pointer.

I'm assuming this as to do with the getwd/getcwd problem. For now I've
compiled it with getwd, simply commenting out the #error line. 

Is this a known problem, has someone already solved this, or am I just doing
something dumb ?

-Chris

==========================================================
Chris Candreva  -- [email-masked] -- (914) 967-7816
WestNet Internet Services of Westchester
http://www.westnet.com/

---

From: Gregory A Lundberg <[email-masked]>
Date: Mon, 30 Aug 1999 16:10:09 -0400

> basicly that we are SOL ?

No, the 2.5.0 daemon should work acceptably well on your server.

> Apparently, it's looking for files in whatever dirrectory ls is run from.

Huh?

> mention of this. If it has been brought up I will happily take a pointer.

Never heard anything like this before.  The only thing which comes to mind
is a guess: try using an ftp client instead of a web browser: does that
make a difference?

> compiled it with getwd, simply commenting out the #error line. 

Maybe, but I'd have to see what is happening.

> Is this a known problem, has someone already solved this, or am I just doing

Yes, yes, and .. well .. maybe.

There's a file, getcwd.c, in the support area, which implementes a portable
getcwd() function for systems which don't have one.  The best thing to do
is to use that function.  That way, the monsterous security deficiency of
your operating system can be overcome, and a more-secure FTP site provided.
The rest of your services are potentially still in-secure, but at least FTP
will be protected from a lot of buffer overruns).

There's a note about this in the ERRATA.  Also, someone has alrady done a
SunOS port fixup for getcwd(), which will appear in 2.6.0 .. I don't recall
if he did anything more than cause the file to be compiled and linked with
the daemon .. maybe added a header.

-- 

Gregory A Lundberg              WU-FTPD Development Group
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195