full-disclosure - Re: Small Design Bug in Postfix

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <e9d9d4020712150553ka22fcf2l79c9fdcded9e5000@mail.gmail.com>
Date: Sat, 15 Dec 2007 07:53:42 -0600
From: reepex <reepex@...il.com>
To: Valdis.Kletnieks@...edu, full-disclosure@...ts.grok.org.uk
Subject: Re: Small Design Bug in Postfix - REMOTE

this kid spent many hard hours reading man pages looking for 0day, gives it
to us along with hello world python networking code ( that is incapable of
parsing replies so any unintended behaviour causes exit), and you are going
to bash it?  You are probably just jealous you do not have the technical
ability required to find these types of vulnerabilities and write reliable
remote exploits for them.

On Dec 14, 2007 3:11 PM, <Valdis.Kletnieks@...edu> wrote:

> On Fri, 14 Dec 2007 13:52:33 CST, Adam N said:
>
> > No, the idea is that you are a user with no login access, only FTP.
> > By doing this, you get shell access (with sane privileges, thankfully)
> when
> > you're supposed to only have FTP.
>
> And this is why, for at least 2 decades, it's been recommended that people
> doing the "FTP-only user" put the writeable directories for that user
> under
> ~ftp/$USER or some such, rather than ~$USER, and make the login shell for
> the
> user /bin/false, and other such things.
>
> For bonus points - if it's an FTP-only userid, why does the sysadmin not
> have e-mail for the userid *blocked*? After all, if they can't login, they
> can't *read* any mail that gets delivered to the system. Even if you fix
> the MTA to drop mail directly in $HOME/mbox, it's the rare FTP daemon that
> understands the locking needed to make this work - that's the primary
> reason why the POP protocol was invented.
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/