Big FTP bug with 11.0 ... is this new?

[someone_4]

Hello

We just found a huge ftp bug in our system.

It seems that if log in though your web browser like so.

ftp:// yourftpuser:yourpassword@home.mydomain.com

contains a space after //

you log into your home directory.


ftp://yourftpuser:yourpassword@home.mydomain.com

does not have a space after //

well to put it short when you put the spage after the // you have root acess to the whole system.

Any ideas?

Richard

[Steven E. Protter · Accepted solution]

swlist -l product | grep -i ftp

What version and vendor of ftp are we running here.

There have been several security alerts on ftp and enhancements available at http://software.hp.com

Several of the security alerts required binary upgrades.

One of the most disconcerting was the one that ignored ftpaccess file blocking root ftp access.

SEP

[Patrick Wallek]

What browser are you using?

I just attempted this with IE on an MS W2K server and could not get logged in with a space after the //. It just kept prompting me for a different username and password.

I may try some more tests from work tomorrow (I'm at home now) where I have more broswers loaded on my WinXP Pro machine.

Also, are you up to date on FTP patches on your machine? You might try searching the ITRC Patch DB and see what FTP patches are available.

[someone_4]

Went to software.hp.com and upgraded to WU-FTP 2.61.

Richard