From owner-freebsd-security Sun Apr 22 20:17:28 2001 Delivered-To: freebsd-security@freebsd.org Received: from sibptus.tomsk.ru (sibptus.tomsk.ru [213.59.238.16]) by hub.freebsd.org (Postfix) with ESMTP id 16DAB37B423 for ; Sun, 22 Apr 2001 20:17:25 -0700 (PDT) (envelope-from sudakov@sibptus.tomsk.ru) Received: (from sudakov@localhost) by sibptus.tomsk.ru (8.9.3/8.9.3) id LAA17574 for freebsd-security@freebsd.org; Mon, 23 Apr 2001 11:16:32 +0800 (KRAST) (envelope-from sudakov) Date: Mon, 23 Apr 2001 11:16:32 +0800 From: Victor Sudakov To: freebsd-security@freebsd.org Subject: Q: Impact of globbing vulnerability in ftpd Message-ID: <20010423111632.B17342@sibptus.tomsk.ru> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.4i Organization: AO "Svyaztransneft", SibPTUS Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org Colleagues: I do not quite understand the impact of the globbing vulnerability. As far as I understand, it can be exploited only after a user has logged in, so ftpd is already chrooted and running with the uid of the user at the moment. What serious trouble can an attacker cause under these conditions? Thank you for any input. -- Victor Sudakov, VAS4-RIPE, VAS47-RIPN 2:5005/149@fidonet http://vas.tomsk.ru/ To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message