Date:         Thu, 15 Mar 2001 14:54:17 -0500
From: Jeff Dafoe <jeffd@EVCOM.NET>
Subject:      Re: Multiple vendors FTP denial of service
To: BUGTRAQ@SECURITYFOCUS.COM

> - PureFTPd (any version) is not vulnerable. Result is "Simplified wildcard
> expression to *" and the 'ls *' output.

	In an ironic twist, PureFTPd (of which you are apparently the author), is
indeed vulnerable to this globbing bug, using variants of the string you
previously posted.  Try:

ls .*./*?/.*./*?/.*./*?/.*./*?/.*./*?/.*./*?/.*./*?/.*./*?/.*./*?/

and

ls */.*/*/.*/*/.*/*/.*/*/.*/*/.*/*/.*/*/.*/*/.*/*/.*/*/.*/*/.*/

	against your software.  To give you the same level of notice you gave
everyone else, I went ahead and posted this into your bug tracking system
about 30 seconds ago.


Jeff