From owner-freebsd-security Fri Dec 1 2:28:42 2000 Delivered-To: freebsd-security@freebsd.org Received: from citusc17.usc.edu (citusc17.usc.edu [128.125.38.177]) by hub.freebsd.org (Postfix) with ESMTP id DEA4237B400 for ; Fri, 1 Dec 2000 02:28:39 -0800 (PST) Received: (from kris@localhost) by citusc17.usc.edu (8.11.1/8.11.1) id eB1AT9844259; Fri, 1 Dec 2000 02:29:09 -0800 (PST) (envelope-from kris) Date: Fri, 1 Dec 2000 02:29:09 -0800 From: Kris Kennaway To: Nevermind Cc: freebsd-security@FreeBSD.ORG Subject: Re: Important!! Vulnerability in standard ftpd Message-ID: <20001201022909.A44090@citusc17.usc.edu> References: <20001201122124.H2185@nevermind.kiev.ua> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-md5; protocol="application/pgp-signature"; boundary="nFreZHaLTZJo0R7j" Content-Disposition: inline User-Agent: Mutt/1.2.5i In-Reply-To: <20001201122124.H2185@nevermind.kiev.ua>; from never@nevermind.kiev.ua on Fri, Dec 01, 2000 at 12:21:24PM +0200 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org --nFreZHaLTZJo0R7j Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Fri, Dec 01, 2000 at 12:21:24PM +0200, Nevermind wrote: > Hello! >=20 > The parallel thread are discussing suspicious=20 > drwxr-xr-x ftp/staff 0 Jul 31 00:04 2000 incoming/* > dirs. I'm 100% sure that it is hack. I've been hacked few month ago this = way. > (with standard ftpd) >=20 > First I've found incoming/~tmp./ dir. > Then I've found suspicious process called "supa" (it may vary, I think). > I don't exactly remember how I found directory in which ls -la said: > ls: .: No such file or directory. >=20 > This hack corrupts filesystem to make it's datadirs invisible. > fsck in single mode severeal times helps. >=20 > It is ttyp* and ttyv* sniffer, logger, password cracker. > Please, check it out! Check what out? Probably your machine has some other vulnerability which was leveraged. You have given us nothing here beyond showing that your ftp server has a world writable directory. Kris --nFreZHaLTZJo0R7j Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.4 (FreeBSD) Comment: For info see http://www.gnupg.org iEYEARECAAYFAjonfXUACgkQWry0BWjoQKW02QCfXG0NiAAcl963v6niKwW6Wn5x 2EYAni0MXDf1HH3IyUhLHxMVCFZqPzA0 =k7/5 -----END PGP SIGNATURE----- --nFreZHaLTZJo0R7j-- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message