Re: compress(vul) + ftpd(?)

From: Pavel Kankovsky (peak@argo.troja.mff.cuni.cz)
Date: 03/11/02 

Date: Mon, 11 Mar 2002 11:35:09 +0100 (MET)
From: Pavel Kankovsky <peak@argo.troja.mff.cuni.cz>
To: H D Moore <sflist@digitaloffense.net>

On Sat, 9 Mar 2002, H D Moore wrote:

> ftp> mkdir A<254 * 0x90>
> ftp> cd A*
[...]
> ftp> put <reallysmallscode>
> ftp> cd ../../../../
> ftp> get A*/B*/C*/D*/reallysmallscode.Z

Afaik this won't work because glob() does not expand the path unless a file
matching the *complete* pattern exists. But if x.Z exists, "get x.Z" will
not run compress. Fortunately, we do not get Catch 22 because there is a
nice race condition there. To make things better, wu-ftpd appears to
compute all filenames matching a pattern during wildcard expansion and
drops everything but the first entry of the list afterwards, ie. it is
possible to make the delay much longer and easier to exploit.

> > BTW: This is an ANCIENT problem.
> You would think it would have been fixed by now ;)

Oh really? ;)

--Pavel Kankovsky aka Peak [ Boycott Microsoft--http://www.vcnet.com/bms ]
"Resistance is futile. Open your source code and prepare for assimilation."

Relevant Pages

  • Re: glob("*.dummy") vs glob("f.dummy")
    ... and there are no files matching, ... directory that could be represented by that pattern. ... Never used csh. ... which is a superset of the POSIX glob() (described in IEEE Std ...
    (comp.lang.perl.moderated)
  • Re: Problem with glob and filenames containing [ and ]
    ... despite what perldoc -f glob says. ... I am also puzzled that quite a few of my test cases (in my second post with example code) including escaped blanks worked exactly as I would have expected. ... fre d.doc ... I can't see how that would happen if the parts of the pattern on each side of the blank were treated as separately - but would be glad to be enlightened. ...
    (comp.lang.perl.misc)
  • Re: (patch for Bash) regex case statement
    ... >same manner as here document delimiter, and regular expression matching ... If pattern is not quoted, ... >the normal glob matching is used. ... change turns "*foo*" into a regex, ...
    (comp.unix.shell)
  • Re: [PHP] file_exists and wildcard/regex
    ... which bfile number exists, i just want to know if any bfile exists. ... I am not familiar with the glob pattern library, ... If you're on a Linux system, you could look at ls and the regular ...
    (php.general)
  • Re: Recurring task
    ... > I am writing an applet that does a calculation.suppose i have a formula ... > how do iwrite a code so that it automatically continues and display ... that you expand the series and a pattern will form very quickly. ...
    (comp.lang.java.help)
Quantcast