Quoted from wu-ftpd group's accouncement:
Due to insufficient bounds checking on directory name lengths which can
be supplied by users, it is possible to overwrite the static memory
space of the wu-ftpd daemon while it is executing under certain
configurations. By having the ability to create directories and
supplying carefully designed directory names to the wu-ftpd, users may
gain privileged access.
PR: 13475
Submitted by: jack@germanium.xtalwind.net
FWIW, checkout of these things took 5+hrs, staying on the local
.freebsd.org net w/o hitting the 'net at all.
As promised,
$ time cvs ci
real 67m51.701s
user 0m1.250s
sys 0m5.345s
Compression of manpages should be dealt with in the FreeBSD port Makefile,
not by patching the dist Makefile. (more obvious to those looking at the
port).
Compression of manpages should be dealt with in the FreeBSD port Makefile,
not by patching the dist Makefile. (more obvious to those looking at the
port).
it anycase, but not tell that S/key password required
It looks like non-s/key system from outside
Additionly tell that s/key required if it is so for normal case
all the COMMENTs! No package names, no version numbers, no "this is
absolutix-3.1.2" type comments that have zero information contents.
Now, without any bad examples to follow, nobody has an excuse to import
a port with those kind of comments. :)
Phew! 238 ports modified!
- Link ftpd static - big win since it forks so often.
- Turn off push flag to keep sender TCP from sending short packets
at the boundaries of each write(). Should probably do a SO_SNDBUF
to set the send buffer size as well, but that may not be desirable
in heavy-load situations.
- Double the send buffer size.
- Add an option to config.h, LOG_TOOMANY, defined by default, that controls
whether we bother to complain when a connection hits a user limit. Turning
this off removes at least 3/4 of the syslog usage of wu-ftpd on a busy
system saving CPU and logspace.
- Make SKEY portions truely optional by one knob in the src Makefile
Obtained from: David Greenman <davidg@FreeBSD.org> and wcarchive
