From owner-freebsd-security  Wed Apr 11  2:49:38 2001
Delivered-To: freebsd-security@freebsd.org
Received: from ajax1.sovam.com (ajax1.sovam.com [194.67.1.172])
	by hub.freebsd.org (Postfix) with ESMTP id 53E6A37B424
	for <security@FreeBSD.ORG>; Wed, 11 Apr 2001 02:49:35 -0700 (PDT)
	(envelope-from avn@any.ru)
Received: from ts9-a156.dial.sovam.com ([195.239.70.156]:1071 "EHLO
	ts9-a156.dial.sovam.com" ident: "avn" whoson: "-unregistered-"
	smtp-auth: <none> TLS-CIPHER: <none> TLS-PEER: <none>)
	by ajax1.sovam.com with ESMTP id <S238303AbRDKJtT>;
	Wed, 11 Apr 2001 13:49:19 +0400
Date:	Wed, 11 Apr 2001 13:48:31 +0400 (MSD)
From: "Alexey V. Neyman" <avn@any.ru>
X-X-Sender:  <avn@srv2.any>
To: Anton Vladimirov <admin128@mail.ru>
Cc: <security@FreeBSD.ORG>
Subject: Re: ftp vulnerability
In-Reply-To: <15739596567.20010411131004@mail.ru>
Message-ID: <Pine.BSF.4.33.0104111346370.56094-100000@srv2.any>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.org

Good day, Anton!

When this hole was patched, libc was also corrected, so you'll need to
update it too. The least painful way will be CVSup, IMHO.

# Alexey

On Wed, 11 Apr 2001, Anton Vladimirov wrote:

>Hello security,
>
>  I run FreeBSD 4.0-RELEASE with all security patches applied.
>  Could anyone clearly explain how to fix the recent
>  ftpd hole for this version?
>
>  I downloaded the sources of ftpd from the 4.2-CURRENT
>  release, but how to install it?
>
>  I do the following:
>=============================================
>bash-2.03# make depend
>yacc  -o ftpcmd.c ftpcmd.y
>yacc: w - the symbol ext_arg is undefined
>rm -f .depend
>mkdep -f .depend -a    -DSETPROCTITLE -DSKEY -DLOGIN_CAP -DVIRTUAL_HOSTING -DINET6 -I/usr/src/libexec/ftpd -Dmain=ls_main -I/usr/src/libexec/c
>cd /usr/src/libexec/ftpd; make _EXTRADEPEND
>echo ftpd: /usr/lib/libc.a /usr/lib/libskey.a /usr/lib/libmd.a /usr/lib/libcrypt.a /usr/lib/libutil.a /usr/lib/libpam.a >> .depend
>bash-2.03# make
>Warning: Object directory not changed from original /usr/src/libexec/ftpd
>cc -O -pipe -DSETPROCTITLE -DSKEY -DLOGIN_CAP -DVIRTUAL_HOSTING -Wall -DINET6 -I/usr/src/libexec/ftpd -Dmain=ls_main -I/usr/src/libexec/ftpd/c
>ftpd.c: In function `send_file_list':
>ftpd.c:2673: `GLOB_MAXPATH' undeclared (first use in this function)
>ftpd.c:2673: (Each undeclared identifier is reported only once
>ftpd.c:2673: for each function it appears in.)
>ftpd.c:2662: warning: variable `dout' might be clobbered by `longjmp' or `vfork'
>ftpd.c:2663: warning: variable `dirlist' might be clobbered by `longjmp' or `vfork'
>ftpd.c:2664: warning: variable `simple' might be clobbered by `longjmp' or `vfork'
>ftpd.c:2665: warning: variable `freeglob' might be clobbered by `longjmp' or `vfork'
>*** Error code 1
>
>Stop in /usr/src/libexec/ftpd.
>==================================================
>
>Where am I mistaken?
>
>
>--
>Best regards,
> Anton                          mailto:admin128@mail.ru
>
>
>
>To Unsubscribe: send mail to majordomo@FreeBSD.org
>with "unsubscribe freebsd-security" in the body of the message
>
>


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message