Re: Multiple vendors FTP denial of service

[Markku Savela <msa () BURP TKV ASDF ORG>]

> > > ftp> ls */../*/../*/../*/../*/../*/../*/../*/../*/../*/../*/../*/../*
> > disable globbing symbols with: DenyFilter "[\*\?]" ?

> ... and as a quick fix for nasty shell users having bash prompts on your machine, just
> enter 'set -f' in the /etc/profile. Of course, until we will get a fixed bash or
> a fixed libc(?).

Is this the same ages old bug of too simple minded wild card matching
algorithm (plagued IRC years ago and was trivially fixed by a globbing
algorithm, that didn't have this problem). I would have expected libs
to have been fixed already...

To test if your system/shell has a bad globbing algorithm, just do

touch aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
ls *a*a*a*a*a*a*a*a*a*a*a*a*a*a*b*

and see if it freezes...