Re: Security hole with WU-FTPD

Article View: comp.security.unix

Article #11

Back to comp.security.unix Previous Next

#11

From: raytodd
Date: Tue, 19 Jan 1999 00:00

17 lines
1932 bytes

>In article <distler-1801991415380001@192.168.0.2>,
>Jacques Distler <distler@golem.ph.utexas.edu> wrote:
>>Color me stupid, but why does he allow root ftp logins, *period*.
>>Shouldn't root be in his ftpusers file?
>
>Even if it were, it wouldn't have helped in this case.  The line that the
>cracker added to /etc/passwd had a UID of 0, but the name wasn't "root".
>The ftpusers file lists names, not UIDs.

I have seen this happen before.  In my case the hacker first broke into an NT
machine (has microsoft ever made a product that was secure? ;-) ) then used
SAMBA to access the server.  I have disable this product and my hacker
problems disappeared.

-----------== Posted via Deja News, The Discussion Network ==----------
http://www.dejanews.com/       Search, Read, Discuss, or Start Your Own

Technical Details

Message-ID: <78290m$30j$1@nnrp1.dejanews.com>

Path: arc1-ca.pugleaf.net!unknown!not-for-mail

References:

<369FBEFB.EB1531B6@gds.ca> <77tkol$b3b$1@nntp.ucs.ubc.ca> <mumfordF5rn4H.B0L@netcom.com> <distler-1801991415380001@192.168.0.2> <%3No2.325$oD6.26447@burlma1-snr1.gtei.net> <distler-1801991517200001@192.168.0.2>

Show Full Headers

Complete Article Headers

X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: 10952f,e0782a6bf0e6f7aa
X-Google-Attributes: gid10952f,public
X-Google-Thread: 102983,e0782a6bf0e6f7aa
X-Google-Attributes: gid102983,public
X-Google-Thread: 10669a,e0782a6bf0e6f7aa
X-Google-Attributes: gid10669a,public
X-Google-Thread: fa777,e0782a6bf0e6f7aa
X-Google-Attributes: gidfa777,public
From: raytodd@consultech.net
Subject: Re: Security hole with WU-FTPD
Date: 1999/01/19
Message-ID: <78290m$30j$1@nnrp1.dejanews.com>
X-Deja-AN: 434413817
References: <369FBEFB.EB1531B6@gds.ca> <77tkol$b3b$1@nntp.ucs.ubc.ca> <mumfordF5rn4H.B0L@netcom.com> <distler-1801991415380001@192.168.0.2> <%3No2.325$oD6.26447@burlma1-snr1.gtei.net> <distler-1801991517200001@192.168.0.2>
X-Http-Proxy: 1.0 x10.dejanews.com:80 (Squid/1.1.22) for client 12.2.38.10
Organization: Deja News - The Leader in Internet Discussion
X-Article-Creation-Date: Tue Jan 19 15:40:08 1999 GMT
Newsgroups: comp.security.unix,redhat.networking.general,aus.computers.linux,comp.os.linux.networking
X-Http-User-Agent: Mozilla/2.0 (compatible; MSIE 3.0; Windows 95)

Reply to Parent Message