Re: Italian Fastweb "La Mozzerella" FTP client
On Sat, Jan 18, 2003 at 09:19:43AM -0800, Bruce Perens wrote:
> I have asked the upstream maintainer of vsftpd to make it a configuration
> file option to hang up on clients that send repeated PORT commands
> without any intervening file transfer. That way, cooperative sysadmins
> can enable that feature, rather than being open to it at all times.
>
> I'll re-enable that address as soon as I have time to hack my copy of
> vsftpd.
Thanks.
Just a few words to underline that Mozzarella is not in any way endorsed
by Fastweb.
Mozzarella is an abuse, _both_ against Fastweb's network _and_ FTP
servers around the world.
While Cisco fixes its IOS to only allow incoming connections from the
FTP server the PORT commands are sent to (and not from any IP address),
"fixing" the problem on the FTP server side might be the best thing.
Also because mozzarella can be used, apart from its original scope, as a
generic DoS tool against FTP servers. Therefore, hardening FTP server
software to prevent the success of such DoS attacks would be very
important.
Regards,
Guglielmo Bondioni
Reply to: