Re: Redhat Linux 6.0 Problem

[jlewis lewis org]

On Sat, 8 May 1999, Rogier Wolff wrote:

> I've done "dir patch*" to get a listing of all the patches at
> ftp.kernel.org. 
> 
> The "*" expansion is something a shell does. My guess is that they
> didn't want to duplicate the wildcard expansion into wu-ftpd. 

Are you sure?  On a Red Hat 5.2 system I just tested, wu-ftpd has no
problem with a command like "dir patch*" even after I did a "chmod 000 sh"

> Note that a shell doesn't have any special privileges. So, indeed for
> convenience, exploits regularly do 'exec ("/bin/sh")', but in fact

No...but it means if they find a buffer overflow, there's a nice /bin/sh
to exec in the chroot area.  So far, I've found no compelling reason for
/home/ftp/bin/sh to exist.

----don't waste your cpu, crack rc5...www.distributed.net team enzo---
 Jon Lewis *jlewis lewis org*|  Spammers will be winnuked or 
 System Administrator        |  nestea'd...whatever it takes
 Atlantic Net                |  to get the job done.
_________http://www.lewis.org/~jlewis/pgp for PGP public key__________