User: Password:
|
|
Subscribe / Log in / New account

Fedora alert FEDORA-2010-17220 (proftpd)

From:  updates@fedoraproject.org
To:  package-announce@lists.fedoraproject.org
Subject:  [SECURITY] Fedora 12 Update: proftpd-1.3.3c-1.fc12
Date:  Thu, 11 Nov 2010 22:15:35 +0000
Message-ID:  <20101111221535.6DE61110C21@bastion02.phx2.fedoraproject.org>
Archive-link:  Article, Thread

-------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2010-17220 2010-11-03 20:29:40 -------------------------------------------------------------------------------- Name : proftpd Product : Fedora 12 Version : 1.3.3c Release : 1.fc12 URL : http://www.proftpd.org/ Summary : Flexible, stable and highly-configurable FTP server Description : ProFTPD is an enhanced FTP server with a focus toward simplicity, security, and ease of configuration. It features a very Apache-like configuration syntax, and a highly customizable server infrastructure, including support for multiple 'virtual' FTP servers, anonymous FTP, and permission-based directory visibility. This package defaults to the standalone behavior of ProFTPD, but all the needed scripts to have it run by xinetd instead are included. -------------------------------------------------------------------------------- Update Information: This is an update to the current upstream maintenance release, which addresses two security issues that can be exploited by malicious users to manipulate certain data and compromise a vulnerable system. * A logic error in the code for processing user input containing the Telnet IAC (Interpret As Command) escape sequence can be exploited to cause a stack-based buffer overflow by sending specially crafted input to the FTP or FTPS service. Successful exploitation may allow execution of arbitrary code. This has been assigned the name CVE-2010-4221. More details can be found at http://bugs.proftpd.org/show_bug.cgi?id=3521 * An input validation error within the "mod_site_misc" module can be exploited to e.g. create and delete directories, create symlinks, and change the time of files located outside a writable directory. Only configurations using "mod_site_misc", which is not enabled by default, and where the attacker has write access to a directory, are vulnerable to this issue, which has been assigned CVE-2010-3867. More details can be found at http://bugs.proftpd.org/show_bug.cgi?id=3519 The update from 1.3.2d to 1.3.3c also includes a large number of non-security bugfixes and a number of additional loadable modules for enhanced functionality: * mod_geoip * mod_sftp * mod_sftp_pam * mod_sftp_sql * mod_shaper * mod_sql_passwd * mod_tls_shmcache There is also a new utility "ftpscrub" for scrubbing the scoreboard file. -------------------------------------------------------------------------------- ChangeLog: * Mon Nov 1 2010 Paul Howarth <paul@city-fan.org> 1.3.3c-1 - Update to 1.3.3c (#647965) - Fixed Telnet IAC stack overflow vulnerability (ZDI-CAN-925) - Fixed directory traversal bug in mod_site_misc (CVE-2010-3867) - Fixed SQLite authentications using "SQLAuthType Backend" - New DSO module: mod_geoip * Fri Sep 10 2010 Paul Howarth <paul@city-fan.org> 1.3.3b-1 - Update to 1.3.3b - Fixed SFTP directory listing bug - Avoid corrupting utmpx databases on FreeBSD - Avoid null pointer dereferences during data transfers - Fixed "AuthAliasOnly on" anonymous login * Fri Jul 2 2010 Paul Howarth <paul@city-fan.org> 1.3.3a-1 - Update to 1.3.3a - Added Japanese translation - Many mod_sftp bugfixes - Fixed SSL_shutdown() errors caused by OpenSSL 0.9.8m and later - Fixed handling of utmp/utmpx format changes on FreeBSD * Thu Feb 25 2010 Paul Howarth <paul@city-fan.org> 1.3.3-1 - Update to 1.3.3 (see NEWS for list of fixed bugs) - Update PID file location in initscript - Drop upstreamed patches - Upstream distribution now includes mod_exec, so drop unbundled source - New DSO modules: - mod_sftp - mod_sftp_pam - mod_sftp_sql - mod_shaper - mod_sql_passwd - mod_tls_shmcache - Configure script no longer appends "/proftpd" to --localstatedir option - New utility ftpscrub for scrubbing the scoreboard file - Include public key blacklist and Diffie-Hellman parameter files for mod_sftp in %{_sysconfdir} - Remove IdentLookups from config file - disabled by default now * Mon Feb 15 2010 Paul Howarth <paul@city-fan.org> 1.3.2d-1 - Update to 1.3.2d, addressing the following issues: - mod_tls doesn't compile with pre-0.9.7 openssl (bug 3358) - Lack of PID protection in ScoreboardFile (bug 3370) - Crash when retrying a failed login with mod_radius being used (bug 3372) - RADIUS authentication broken on 64-bit platforms (bug 3381) - SIGHUP eventually causes certain DSO modules to segfault (bug 3387) * Thu Dec 10 2009 Paul Howarth <paul@city-fan.org> 1.3.2c-1 - Update to 1.3.2c, addressing the following issues: - SSL/TLS renegotiation vulnerability (CVE-2009-3555, bug 3324) - Failed database transaction can cause mod_quotatab to loop (bug 3228) - Segfault in mod_wrap (bug 3332) - <Directory> sections can have <Limit> problems (bug 3337) - mod_wrap2 segfaults when a valid user retries the USER command (bug 3341) - mod_auth_file handles 'getgroups' request incorrectly (bug 3347) - Segfault caused by scrubbing zero-length portion of memory (bug 3350) - Drop upstreamed segfault patch * Thu Dec 10 2009 Paul Howarth <paul@city-fan.org> 1.3.2b-3 - Add patch for upstream bug 3350 - segfault on auth failures * Wed Dec 9 2009 Paul Howarth <paul@city-fan.org> 1.3.2b-2 - Reduce the mod_facts patch to the single commit addressing the issue with directory names with glob characters (#521634), avoiding introducing a further problem with <Limit> (#544002) -------------------------------------------------------------------------------- References: [ 1 ] Bug #651607 - CVE-2010-4221 proftpd: multiple stack-based buffer overflows in pr_netio_telnet_gets() https://bugzilla.redhat.com/show_bug.cgi?id=651607 [ 2 ] Bug #651602 - CVE-2010-3867 proftpd: multiple directory traversal vulnerabilities https://bugzilla.redhat.com/show_bug.cgi?id=651602 -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update proftpd' at the command line. For more information, refer to "Managing Software with yum", available at http://docs.fedoraproject.org/yum/. All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list package-announce@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/package-...


(Log in to post comments)


Copyright © 2017, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds