Description:
------------
ftps:// opendir wrapper seems to be vulnerable to protocol downgrade attack.

When user requests ftps:// connection, php_ftp_fopen_connect() in ext/standard/ftp_fopen_wrapper.c first attempts to use AUTH TLS followed by attempt to use AUTH SSL if that follows. If FTP server, or attacker, responds with status codes other than 234 for AUTH TLS and 334 for AUTH SSL, wrapper will silently downgrade the connection to regular FTP. Relevant code:

    if (use_ssl)    {

        /* send the AUTH TLS request name */
        php_stream_write_string(stream, "AUTH TLS\r\n");

        /* get the response */
        result = GET_FTP_RESULT(stream);
        if (result != 234) {
            /* AUTH TLS not supported try AUTH SSL */
            php_stream_write_string(stream, "AUTH SSL\r\n");

            /* get the response */
            result = GET_FTP_RESULT(stream);
            if (result != 334) {
                use_ssl = 0;
            } else {


Test script:
---------------
Execute against server that doesn't support ftps.

$dir=opendir('ftps://ftp.funet.fi/');
var_dump($dir);

Expected result:
----------------
bool(false)

TCP session between the client and server:

S: 220---------- Welcome to Pure-FTPd ----------
C: AUTH TLS
S: 500 This security scheme is not implemented
C: AUTH SSL
S: 500 This security scheme is not implemented

(connection terminated)

Actual result:
--------------
resource(%d) of type (stream)

TCP session between the client and server:

S: 220---------- Welcome to Pure-FTPd ----------
C: AUTH TLS
S: 500 This security scheme is not implemented
C: AUTH SSL
S: 500 This security scheme is not implemented
C: USER test
S: 331-Welcome to the FUNET anonymous ftp archive
C: PASS test
S: 230 Any password will work