>Number:         5531
>Category:       bin
>Synopsis:       invalid 550 reply in ftpd
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    bin-bug-people (Utility Bug People)
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Jun  3 02:05:02 1998
>Last-Modified:
>Originator:     SAITOH Masanobu
>Organization:
University of Electro-Communications
>Release:        latest -current
>Environment:
System: NetBSD ifree.spa.is.uec.ac.jp 1.3E NetBSD 1.3E (IFREE) #65: Sun May 17 13:52:34 JST 1998 msaitoh@ifree.spa.is.uec.ac.jp:/export/ifree/sources/src/sys/arch/i386/compile/IFREE i386


>Description:
	If a getcwd() function fails in ftpd.c::pwd(), the ftp server may
	produce a bad reply message. (It occasionally produces multiple lines).

	Example:

 > % ftp ftp
 > Connected to xxx.yyy.zzz.
 > 220 xxx.yyy.zzz FTP server (Version 7.02) ready.
 > Name (ftp:nazo): ftp
 > 331 Guest login ok, type your name as password.
 > Password: 
 > 230- Welcome to ftp.yyy.zzz
 > 230- 
 > 230-    .tar, .gz and .tar.gz conversion is ready.
 > 230- 
 > 230 Guest login ok, access restrictions apply.
 > ftp> cd /hidden/zzz		<=== /hidden is set with d--x--x--x
 > 250 CWD command successful.
 > ftp> pwd
 > 550 or allowed) ftp access	<=== Garbage!
 > ftp> pwd                          In this case, "or allowed) ftp access"
 > .                                 is a text of /etc/ftpusers!
 > ftp> ls -l
 > 550 or allowed) ftp access   <=== Garbage!
 > .
 > ftp> ls -l
 > 200 PORT command successful.
 > 425 Can't build data connection: Connection refused. <=== Ah.
 > ftp> ls -l
 > 200 PORT command successful.
 > 150 Opening ASCII mode data connection for '/bin/ls'.
 > total 158
 > -rw-r--r--  1 msaitoh  wheel  19635 Apr 20 07:58 aaa
 > -rw-r--r--  1 msaitoh  wheel  20190 Apr 21 15:09 bbb
 > -rw-r--r--  1 msaitoh  wheel  20685 Jun  2 23:22 ccc
 > -rw-r--r--  1 msaitoh  wheel  18111 Jul 28  1995 ddd
 > 226 Transfer complete.
   .
   .
   .

>How-To-Repeat:

>Fix:
	Apply following patch:

--- ftpd.c.orig	Tue Feb 24 21:08:26 1998
+++ ftpd.c	Wed Jun  3 16:20:11 1998
@@ -1498,7 +1498,7 @@
 	char path[MAXPATHLEN + 1];
 
 	if (getcwd(path, sizeof(path) - 1) == NULL)
-		reply(550, "%s.", path);
+		reply(550, "Can't get the current directory.");
 	else
 		replydirname(path, "is the current directory.");
 }
--- conf.c.orig	Thu Apr  2 21:17:06 1998
+++ conf.c	Wed Jun  3 16:52:24 1998
@@ -322,7 +322,7 @@
 
 		/* Check if this directory has already been visited */
 	if (getcwd(cwd, sizeof(cwd) - 1) == NULL) {
-		syslog(LOG_WARNING, "can't malloc");
+		syslog(LOG_WARNING, "can't getcwd");
 		return;
 	}
 	if (sl_find(slist, cwd) != NULL)

>Audit-Trail:
>Unformatted: