Subject: Re: ftp(1) security hole, and suggested fixes
To: None <lm@rmit.edu.au>
From: Darren Reed <darrenr@cyber.com.au>
List: tech-security
Date: 08/18/1997 11:46:28
hmmm, come to think of it, I've used "mget .???*" to transfer all my dot-files
from one account to another...I don't think doing "mget ../*" should retrieve
.* files, so maybe screen against them there...

what about a nasty ftp server that sends back an obligitory .rhosts file to
../../../../../../.rhosts ?  i.e. it responds to an mget with that in the
list (maybe that's streching it too far...).  Anyone for adding in a chroot()
to `pwd` for ftp when receiving files as root ? ;)

neither should mget retrieve things to shells, IMHO, and to do so should
require it to be like:

get README.TXT "|more"

Darren