Subject: Re: Redhat Linux 6.0 Problem

From: [email-masked]
Date: Sat, 8 May 1999 10:08:14 -0400 (EDT)

On Sat, 8 May 1999, Rogier Wolff wrote:

> I've done "dir patch*" to get a listing of all the patches at
> ftp.kernel.org. 
> 
> The "*" expansion is something a shell does. My guess is that they
> didn't want to duplicate the wildcard expansion into wu-ftpd. 

Are you sure?  On a Red Hat 5.2 system I just tested, wu-ftpd has no
problem with a command like "dir patch*" even after I did a "chmod 000 sh"

> Note that a shell doesn't have any special privileges. So, indeed for
> convenience, exploits regularly do 'exec ("/bin/sh")', but in fact

No...but it means if they find a buffer overflow, there's a nice /bin/sh
to exec in the chroot area.  So far, I've found no compelling reason for
/home/ftp/bin/sh to exist.

----don't waste your cpu, crack rc5...www.distributed.net team enzo---
 Jon Lewis [email-masked]*|  Spammers will be winnuked or 
 System Administrator        |  nestea'd...whatever it takes
 Atlantic Net                |  to get the job done.
_________http://www.lewis.org/~jlewis/pgp for PGP public key__________

---

From: Gregory A Lundberg <[email-masked]>
Date: Mon, 10 May 1999 09:38:07 -0400 (EDT)

> didn't want to duplicate the wildcard expansion into wu-ftpd.

Filename globbing works fine in WU-FTPD so you have something else wrong.

-- 

Gregory A Lundberg              Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195