Ftp-WG: PASV and Snap servers

At 11:12 AM 12/18/2002, you wrote:
>The one difference that I notice is that Fetch sends the LIST command 
>right after the SYN for the data connection, while the OS X ftp client 
>does not send LIST until the data connection is actually 
>established.  Should clients make the data connection first and then send 
>the data-transferring command?

Yes.  Doing otherwise is a security hazard, because you've told it to 
transfer a file before you're aware that you have a connection.  Suppose 
that I, an evil external hacker, could guess what port is going to be 
returned next time you send the PASV command?  Then I could just repeatedly 
try to connect to that port, and if I make it before you, then I could get 
quite a lot of the data transfer before you notice that you haven't got a 
connection.

Alun.
~~~~

--
Texas Imperial Software   | Try WFTPD, the Windows FTP Server. Find us at
1602 Harvest Moon Place   | http://www.wftpd.com or email [email protected]
Cedar Park TX 78613-1419  | VISA/MC accepted.  NT-based sites, be sure to
Fax/Voice +1(512)258-9858 | read details of WFTPD Pro for NT.