COMMAND
	    /etc/ftpchroot
SYSTEMS AFFECTED
	    NetBSD-1.4.2 only
PROBLEM
	    Following is  based on  NetBSD Security  Advisory.   The chroot(2)
	    system call, short for "change root", restricts a process to  only
	    be able to access a subtree of the filesystem.
	    /etc/ftpchroot specifies users who are allowed to log in using ftp
	    with  a  password,  but  are  chroot'ed  to  their home directory,
	    preventing them from accessing files outside their home  directory
	    via FTP.  The incorrect fix in 1.4.2 caused the chroot call to not
	    occur,  allowing  them  regular,  unpriviledged  access  to  files
	    outside their home directory via FTP.
	    This problem was originally found by Paul J. Lavoie.
SOLUTION
	    The  fix  is  to  back  out  the  incorrect half of the fix.  This
	    problem affects only  NetBSD-1.4.2 and versions  of NetBSD-current
	    between 19990930 and 19991212; it does not affect NetBSD-1.4.1  or
	    earlier, or  versions of  NetBSD-current after  19991212 or before
	    19990930.  If you  do not need to  use /etc/ftpchroot, you do  not
	    need to take any action.
	    If you're running NetBSD-current fetched between the above  dates,
	    update to a newer version of NetBSD-current.
	    If you're  runing NetBSD-1.4.2,  fetch the  following patch, apply
	    it to src/libexec/ftpd/ftpd.c using the patch(1) command,  rebuild
	    and reinstall  ftpd, and  kill off  any existing  FTP daemons  (to
	    ensure that any improperly granted access is revoked):
	
	        ftp://ftp.NetBSD.ORG/pub/NetBSD/misc/security/patches/20000527-ftpd
	
	    Since the patch is small, it is reproduced inline here:
	
	    *** ftpd.c	1999/10/01 12:08:06	1.61.2.1
	    --- ftpd.c	2000/05/11 10:14:37	1.61.2.2
	    ***************
	    *** 489,496 ****
	  		    if (glob == NULL || glob[0] == '#')
	  			    continue;
	  		    perm = strtok(NULL, " \t\n");
	    - 		if (perm == NULL)
	    - 			continue;
	  		    if (fnmatch(glob, name, 0) == 0)  {
	  			    if (perm != NULL &&
	  			        ((strcasecmp(perm, "allow") == 0) ||
	    --- 489,494 ----