Re: [Proftpd-user] Bug 4169

On Wed, Dec 7, 2016, at 14:12, Mark Moseley wrote:
> http://bugs.proftpd.org/show_bug.cgi?id=4169
> 
> We're investigating this and it still seems like it's exploitable on
> 1.3.6rc2. I just ran through the same steps in the above link on a
> freshly rolled 1.3.6rc2 and it copied /etc/passwd to /tmp/passwd.copy
> 
> Looking at the git commits, the entry that says it fixes 4169 doesn't
> have any code that seems to be related (there's a single mod_sftp patch).

Could you provide the exact steps/sequence of commands you are using to
build, install, and test this?  As using the steps in the bug report
with proftpd-1.3.6rc2 locally, and using the regression tests for this
issue, I cannot reproduce the behavior.

As for the git commits, the related code/fix is the addition of checks
for whether the client has authenticated, i.e.:

    authenticated = get_param_ptr(cmd->server->conf, "authenticated",
    FALSE);
    if (authenticated == NULL ||
        *authenticated == FALSE) {

Cheers,
TJ

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most 
engaging tech sites, SlashDot.org! http://sdm.link/slashdot
_______________________________________________
ProFTPD Users List   <[email protected]>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html