From owner-freebsd-security Tue Oct 3 9:22:14 2000 Delivered-To: freebsd-security@freebsd.org Received: from lariat.org (lariat.org [12.23.109.2]) by hub.freebsd.org (Postfix) with ESMTP id 787B237B503 for ; Tue, 3 Oct 2000 09:22:11 -0700 (PDT) Received: from mustang.lariat.org (IDENT:ppp0.lariat.org@lariat.org [12.23.109.2]) by lariat.org (8.9.3/8.9.3) with ESMTP id KAA18735; Tue, 3 Oct 2000 10:18:57 -0600 (MDT) Message-Id: <4.3.2.7.2.20001003094705.04c60580@localhost> X-Sender: brett@localhost X-Mailer: QUALCOMM Windows Eudora Version 4.3.2 Date: Tue, 03 Oct 2000 10:18:47 -0600 To: Max Khon , Neil Blakey-Milner From: Brett Glass Subject: Re: ftpd bug in FreeBSD through at least 3.4 Cc: "Chris D . Faulhaber" , security@FreeBSD.ORG In-Reply-To: References: <20001002204526.A58098@mithrandr.moria.org> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org At 11:20 PM 10/2/2000, Max Khon wrote: >> Using binary mode to transfer files. >> ftp> quot %s%s%s%s >> 500 '%S%S%S%S': command not understood. >> >> A 3.4 ftp client to 'futon' also segfaults. The ftp server doesn't >> segfault in the cases I've tried. > >this was fixed in HEAD, RELENG_4 and RELENG_3 on Jun 23 2000 >(cmds.c 1.17, 1.16.2.1 and 1.14.2.3) > >/fjoe This fixes the bug in the client, which goes ALL THE WAY BACK to Berkeley ftp of ages past. I believe that this is the source of the problem in the Microsoft client, too, as it is BSD-derived. Don't know about the Linux code, but I would not be surprised if it were cribbed from BSD (possibly without attribution -- and, if so, in violation of the BSD license). I am beginning to think that this bug exists in a very large percentage of the command line ftp clients in the world. Am still checking out various servers. Some do behave strangely when fed strings with %s and (especially) %n. --Brett To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message