[15611] in bugtraq
Re: ftpd: the advisory version
daemon@ATHENA.MIT.EDU (D. J. Bernstein)
Sun Jul 2 16:27:34 2000
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Message-Id: <20000701142327.10246.qmail@cr.yp.to>
Date: Sat, 1 Jul 2000 14:23:27 -0000
Reply-To: "D. J. Bernstein" <djb@CR.YP.TO>
From: "D. J. Bernstein" <djb@CR.YP.TO>
To: BUGTRAQ@SECURITYFOCUS.COM
Clients should not---and, as far as I know, do not---check the source
TCP port for active connections from the server. See
http://cr.yp.to/ftp/security.html
for further comments on FTP protocol security issues.
Please note that publicfile isn't just for sites where ``all you need is
anonymous FTP.'' You can run publicfile as your anonymous FTP server,
and run a non-anonymous FTP server on another port or IP address. (Many
of wuftpd's security holes have required the attacker to log in first.)
Similarly, you can use publicfile for static HTTP files, and another
server for dynamic HTTP files.
---Dan
