On Wed, Mar 06, 2002 at 09:48:46AM -0500, Noah L. Meyerhans wrote: > On Wed, Mar 06, 2002 at 10:36:03AM +0100, Francesco P. Lovergine wrote: > > > > potato version is not exploitable (patched with a backported hack many > > months ago). See old DSA on www.debian.org. > > > > No, it is still vulnerable. I have confirmed for myself that the fix > applied in the DSA did not eliminate the DoS. The only way to be safe > right now is to add the following to /etc/proftpd.conf: > <Global> > DenyFilter \*.*/ > </Global> > > The problem is not likely with proftpd, but with glibc. I am going to > begin investigating fixes ASAP. > > noah >
glibc has been patched for glob problems too. There is a not too old thread about the same subject... -- Francesco P. Lovergine
