Bug 31719

 Submitter-Id:	current-users
 Originator:	Anatoly Karp
 Organization:	private
 Confidential:	no 
 Synopsis:	man ftpd(8) omits potentially crucial security warning
 Severity:	serious
 Priority:	high
 Category:	docs
 Class:		doc-bug 
 Release:	FreeBSD 4.4-STABLE i386
 Environment:
 System: FreeBSD rust098-017.resnet.wisc.edu 4.4-STABLE FreeBSD 4.4-STABLE #1: Wed Oct 31 03:26:58 CST 2001 karp@rust098-017.resnet.wisc.edu:/usr/obj/usr/src/sys/TOL_KERN6 i386
 
 
 Description:
 Man ftpd(8) suggests giving ~ftp/pub directory the permission
 bits of 777 without adequately explaining potentially
 unpleasant security implications of such a step. It is
 suggested that
 
 
 How-To-Repeat:
 $ man ftpd
 
 <snip>
          ~ftp/pub  Make this directory mode 777 and owned by ``ftp''.
                    Guests can then place files which are to be accessible
                    via the anonymous account in this directory.
 <snip>
 
 Fix:
 
 Change the corresponding paragraph to, say:
 
         ~ftp/pub  Make this directory mode 700 and owned by ``ftp''.
                   Making this directory world-writable will
 		  open you to a variety of DoS attacks as
 		  well as being used for warez.