Re:MacOS X 10.10 and FreeBSD 10 Ftp Remote Comand Execution
by dmm on Wednesday October 29, 2014 @10:09AM
(#8527208)
In OpenBSD the ftp(1) program /is/ the cli http client for the base system. wget is available in ports but not install by default. FreeBSD is probably similar
[ Parent
| on HN ]
Re:MacOS X 10.10 and FreeBSD 10 Ftp Remote Comand Execution
by Wilya on Wednesday October 29, 2014 @11:00AM
(#8527498)
The wget-like utility present in the FreeBSD base system is fetch(1). It is a cli for the underlying libfetch, which provides HTTP/FTP client functions, and is used behind the scenes in a lot of places in the FreeBSD base, notably by all the package manager and ports systems.
The vulnerable ftp we're talking about here is a completely distinct piece of software, which is generally used only when you want to interactively browse a ftp server. But it doesn't seem to be related much to fetch(1). It has obviously common origins with the OpenBSD one, but I can't comment on how vulnerable the OpenBSD version is.
Re:MacOS X 10.10 and FreeBSD 10 Ftp Remote Comand Execution
by glass- on Wednesday October 29, 2014 @11:18AM
(#8527616)
As an aside, this bug was fixed in OpenBSD's ftp(1) 5 years ago.
http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ftp/fet...