FTPSERV.NLM v 10.31 includes the same security fixes from v10.30, plus the addition of a abend fix:
- FTPSERV.NLM could experience a Page Fault abend when certain FTP clients attempt to abort a FTP operation. Windows DOS-based clients send an unexpected NULL (00h) value as part of their ABORT (ABOR) sequence. FTPSERV was not able to handle this. The pointer to the command in memory would become invalid, which sometimes would result in a Page Fault. FTPSERV.NLM has been modified to remove the NULL value before processing the command.
Other fixes, previously included in FTPSERV.NLM v10.30:
-Two security weaknesses for anonymous user access have been eliminated. For the protection of systems that may not yet be patched, these security problems will not be discussed in detail. These weaknesses could allow the anonymous user to access areas outside the anonymous home directory structure, in certain very specific circumstances.
-Fixed a problem which had been previously introduced in FTPSERV 10.19, whereby FTPSERV.NLM could stop functioning. The most common trigger for this failure was a user who attempted to GET a non-existant (or misspelled) file. After that, other FTP connections would fail and the following error would appear on the system console:
CLib-4.11-005: Unable to open standard consoles new thread group. There may not be enough server memory, or server memory may be corrupted.
-Removed a previous fix involving the ability to rename files when the FTP session is using LONG namespace. The previous fix enabled the rename ability in LONG name space. However, the new filename did not take effect in any of the other name spaces (DOS, MAC, NFS). That fix was removed. To rename with FTPSERV.NLM, you must use DOS or NFS name space.
Sidenote: FTPSERV.NLM originally only supported DOS and NFS name space. Support for LONG name space was added as an enhancement in FTPSERV.NLM 9.x, but numerous issues such as the renaming problem above were discovered. To completely fix the issues with FTPSERV.NLM and LONG namespace, FTP had to be redesigned. The fully redesigned FTP Server is part of NetWare 5.1 and NetWare 6.0.
Simply as reference, below are some noteworthy prior fixes (which already existed in the last NW 4 and NW 5.0 support packs):
-GET or PUT commands which make use of a full, remote server path might fail. (i.e. PUT //SERVER2/VOL1/DIR1 ). These failure only occurred in FTP sessions defaulting to LONG namespace, and sometimes only between certain NetWare OS version combinations. These failures have been corrected.
-When using LONG name space, the FTP Server would not list files containing 3 or more dots in their names. FTPSERV.NLM will now display files with up to 9 dots in their names.
-During an ASCII type PUT operation, FTPSERV.NLM would strip out any bytes of hex 1A. This has been corrected.
-Various abend fixes were made, including a common abend in FTPSERV.NLM, code offset 10523h.
|