Date: Mon, 14 Oct 1996 18:30:18 -0700 From: Jason Downs <downsj@teeny.org> To: Marc Slemko <marcs@znep.com> Cc: freebsd-bugs@freefall.freebsd.org Subject: Re: bin/1805: Bug in ftpd Message-ID: <199610150130.SAA09758@threadway.teeny.org> In-Reply-To: Your message of "Mon, 14 Oct 1996 11:20:02 PDT." <199610141820.LAA14810@freefall.freebsd.org>
next in thread | previous in thread | raw e-mail | index | archive | help
In message <199610141820.LAA14810@freefall.freebsd.org>, Marc Slemko writes: >The following reply was made to PR bin/1805; it has been noted by GNATS. > >From: Marc Slemko <marcs@znep.com> >To: rkozak@bdk.lublin.pl >Cc: freebsd-gnats-submit@freebsd.org >Subject: Re: bin/1805: Bug in ftpd >Date: Mon, 14 Oct 1996 12:11:11 -0600 (MDT) > > On Mon, 14 Oct 1996 rkozak@bdk.lublin.pl wrote: > > > While user is connected to server via ftp, the process ftpd is owned > > by this user. When ftpd is abnormally termineted (e.g. kill -11 <ftpd-id>) > > the memory image of this process is writed to file ftpd.core in home dir. > > This file contain encrypted passwords all users on this machine. > > That isn't nice. I don't think it will contain the passwords of all the > users, just a certain subset of them. This also a problem with older > versions of wuftpd, but the latest beta seems to be fine, although I'm not > sure if that is just a fluke or by design. There are several possible > fixes, but for those that need a temporary fix ASAP, a workaround follows. > There should be no security problems with this, but there could be > something I'm missing. I don't think disabling core dumps is a very clean or effective fix for this problem. a.) the problem is potentially wide spread, and b.) is caused by the design (limitations) of the DB library. The problem was killed by making essentially a one line change in the OpenBSD source tree. A slight performance hit is exchanged for greater overall security. -- Jason Downs (503) 256-8535 -/- (503) 952-3749 downsj@teeny.org --> teeny.org: Free Software for a Free Internet <-- http://www.teeny.org/ OpenBSD: The BSD with a soul. http://www.openbsd.org/
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?199610150130.SAA09758>