U radu programskog paketa ProFTPD, distribuiranog s operacijskim sustavima Fedora 13 i 14, otkriven je sigurnosni propust. ProFTPD je besplatni poslužitelj koji omogućuje sigurnu i jednostavnu razmjenu podataka na mreži koristeći protokol FTP. Propust je posljedica prepisivanja spremnika na gomili prilikom obrade pojedinih korisničkih imena, a očituje se kad je uključen modul "mod_sql". Udaljeni ga napadač može iskoristiti za izvođenje DoS napada ili pokretanje proizvoljnog programskog koda. Korisnicima se savjetuje prelazak na ispravljene inačice.
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2011-0613
2011-01-20 19:26:18
--------------------------------------------------------------------------------
Name : proftpd
Product : Fedora 13
Version : 1.3.3d
Release : 1.fc13
URL : http://www.proftpd.org/
Summary : Flexible, stable and highly-configurable FTP server
Description :
ProFTPD is an enhanced FTP server with a focus toward simplicity, security,
and ease of configuration. It features a very Apache-like configuration
syntax, and a highly customizable server infrastructure, including support for
multiple 'virtual' FTP servers, anonymous FTP, and permission-based directory
visibility.
This package defaults to the standalone behavior of ProFTPD, but all the
needed scripts to have it run by xinetd instead are included.
--------------------------------------------------------------------------------
Update Information:
This is an update to the current upstream maintenance release, which addresses
a security issue that could affect users of the mod_sql module (not enabled by
default).
* A heap-based buffer overflow flaw was found in the way ProFTPD FTP server
prepared SQL queries for certain usernames, when the mod_sql module was enabled.
A remote, unauthenticated attacker could use this flaw to cause the proftpd
daemon to crash or, potentially, to execute arbitrary code with the privileges
of the user running 'proftpd' via a specially-crafted username, provided in the
authentication dialog.
The update also fixes a CPU spike when handling .ftpaccess files, and handling
of SFTP uploads when compression is used.
--------------------------------------------------------------------------------
ChangeLog:
* Wed Jan 19 2011 Paul Howarth <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> 1.3.3d-1
- Updated to 1.3.3d
- Fixed sql_prepare_where() buffer overflow (bug 3536, CVE-2010-4652)
- Fixed CPU spike when handling .ftpaccess files
- Fixed handling of SFTP uploads when compression is used
- Add Default-Stop LSB keyword in initscript (for runlevels 0, 1, and 6)
- Fix typos in config file and initscript
* Mon Nov 1 2010 Paul Howarth <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> 1.3.3c-1
- Update to 1.3.3c (#647965)
- Fixed Telnet IAC stack overflow vulnerability (CVE-2010-4221)
- Fixed directory traversal bug in mod_site_misc (CVE-2010-3867)
- Fixed SQLite authentications using "SQLAuthType Backend"
- New DSO module: mod_geoip
* Fri Sep 10 2010 Paul Howarth <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> 1.3.3b-1
- Update to 1.3.3b
- Fixed SFTP directory listing bug
- Avoid corrupting utmpx databases on FreeBSD
- Avoid null pointer dereferences during data transfers
- Fixed "AuthAliasOnly on" anonymous login
* Fri Jul 2 2010 Paul Howarth <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> 1.3.3a-1
- Update to 1.3.3a
- Added Japanese translation
- Many mod_sftp bugfixes
- Fixed SSL_shutdown() errors caused by OpenSSL 0.9.8m and later
- Fixed handling of utmp/utmpx format changes on FreeBSD
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #670170 - CVE-2010-4652 ProFTPD (mod_sql): Heap-based buffer
overflow by processing certain usernames, when mod_sql module enabled
https://bugzilla.redhat.com/show_bug.cgi?id=670170
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update proftpd' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
_______________________________________________
package-announce mailing list
Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.
https://admin.fedoraproject.org/mailman/listinfo/package-announce
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2011-0610
2011-01-20 19:26:13
--------------------------------------------------------------------------------
Name : proftpd
Product : Fedora 14
Version : 1.3.3d
Release : 1.fc14
URL : http://www.proftpd.org/
Summary : Flexible, stable and highly-configurable FTP server
Description :
ProFTPD is an enhanced FTP server with a focus toward simplicity, security,
and ease of configuration. It features a very Apache-like configuration
syntax, and a highly customizable server infrastructure, including support for
multiple 'virtual' FTP servers, anonymous FTP, and permission-based directory
visibility.
This package defaults to the standalone behavior of ProFTPD, but all the
needed scripts to have it run by xinetd instead are included.
--------------------------------------------------------------------------------
Update Information:
This is an update to the current upstream maintenance release, which addresses
a security issue that could affect users of the mod_sql module (not enabled by
default).
* A heap-based buffer overflow flaw was found in the way ProFTPD FTP server
prepared SQL queries for certain usernames, when the mod_sql module was enabled.
A remote, unauthenticated attacker could use this flaw to cause the proftpd
daemon to crash or, potentially, to execute arbitrary code with the privileges
of the user running 'proftpd' via a specially-crafted username, provided in the
authentication dialog.
The update also fixes a CPU spike when handling .ftpaccess files, and handling
of SFTP uploads when compression is used.
--------------------------------------------------------------------------------
ChangeLog:
* Wed Jan 19 2011 Paul Howarth <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> 1.3.3d-1
- Updated to 1.3.3d
- Fixed sql_prepare_where() buffer overflow (bug 3536, CVE-2010-4652)
- Fixed CPU spike when handling .ftpaccess files
- Fixed handling of SFTP uploads when compression is used
- Add Default-Stop LSB keyword in initscript (for runlevels 0, 1, and 6)
- Fix typos in config file and initscript
* Mon Nov 1 2010 Paul Howarth <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> 1.3.3c-1
- Update to 1.3.3c (#647965)
- Fixed Telnet IAC stack overflow vulnerability (CVE-2010-4221)
- Fixed directory traversal bug in mod_site_misc (CVE-2010-3867)
- Fixed SQLite authentications using "SQLAuthType Backend"
- New DSO module: mod_geoip
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #670170 - CVE-2010-4652 ProFTPD (mod_sql): Heap-based buffer
overflow by processing certain usernames, when mod_sql module enabled
https://bugzilla.redhat.com/show_bug.cgi?id=670170
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update proftpd' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
_______________________________________________
package-announce mailing list
Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.
https://admin.fedoraproject.org/mailman/listinfo/package-announce
Posljednje sigurnosne preporuke