Re: FTP Exit Point (was Re: iSeries FTP security)

Now there's thinking outside the box!  Ask IBM, or submit a DCR.

Rob Berendt
-- 
Group Dekko Services, LLC
Dept 01.073
PO Box 2000
Dock 108
6928N 400E
Kendallville, IN 46755
http://www.dekko.com





"Brad Stone" <brad@xxxxxxxxxxxx> 
Sent by: midrange-l-bounces@xxxxxxxxxxxx
05/17/2005 12:03 PM
Please respond to
Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxx>


To
Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxx>
cc

Subject
FTP Exit Point (was Re: iSeries FTP security)






Ok, so a few pieces of software were deemed "vunerable" by
this method.

My question is this, is it a bug in the FTP Exit Point or
an oversight in the FTP exit program vendors?

Normally the FTP exit point returns the full path to the
object in question.  Why wouldn't it parse these paths with
../ down in them as well?

For example, I do

cd /tmp
cd myfiles
get file.txt

The exit point returns /tmp/myfiles/file.txt as the object.

For /tmp/myfiles/dir2/../file.txt why also wouldn't it
return /tmp/myfiles/file.txt?

Brad
-- 
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing 
list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.