[2.0.1] ftp_root.nasl problem + possible fix

Brian Costello <[email protected]>
Newsgroups gmane.comp.security.nessus.devel
Message-ID <[email protected]>
Hi,

Again, hopefully this is the correct group for this, but I have run into a
problem with ftp_root.nasl, and the only way I found to fix it was as
follows:

In case you don't know, ftp_root.nasl checks whether a user has write access
to the root dir of an anonymous FTP server.

Anyway, despite having set up several different test FTP servers with this
vuln (linux & solaris), this rule never fired for me.  After debugging, I
was able to figure out that the offending line was:

pasv = ftp_get_pasv_port(socket:soc);

Prior to commenting this line out, the revc_line fcn 3 lines down always
returned nada.  Commenting the pasv line out made everything work for me -
all we want is the 425 or 150, which should be sent prior to the PORT
command being sent (it seems to at least) so I don't see why it was
necessary to put the script into passive mode.

Brian
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.