ftpd security issue ?

[Xin Li]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi, Mike,

On 12/05/11 12:34, Mike Tancsa wrote:
> On 12/5/2011 2:48 PM, Xin Li wrote:
>> 
>> Currently no (I thought you were in the cc list in my discussion
>> with kib@?).  My initial plan was simply rejecting .so's with
>> wrong permissions but in the discussion turns out that would not
>> be sufficient and we have also considered other ways to do it,
>> e.g. have a wrapper where one can disable them completely.  I
>> have not a full solution yet as the change would touch quite a
>> lot of things in the base system...
> 
> Hi Xin, yes, I am on the cc list. I vaguely understand the
> complexity of the issue enough to see its not an easy fix.  In the
> mean time, I was just looking for ways to protect the few boxes I
> have that run proftpd. Right now running with "rootrevoke on" seems
> to be the safest, but that has the side effect of killing active
> connections.

Oh for now you would probably need to patch proftpd and rtld-elf so
that proftpd after chroot immediately tell rtld-elf that no .so's
should be loaded from that point.  I don't think I would be able to do
anything before office hours as I'm working on something else for the
company now.

Cheers,
- -- 
Xin LI <delphij at delphij.net>	https://www.delphij.net/
FreeBSD - The Power to Serve!		Live free or die
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.18 (FreeBSD)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk7dLKsACgkQOfuToMruuMAaEwCdHb22DlVkmyzwEwk2c9o+D8gG
zpUAn3RvnzzL3LIf6JXh7jH5WLQYY7aE
=W4Ob
-----END PGP SIGNATURE-----