U radu programskog paketa vsftpd (eng. Very Secure File Transfer Protocol daemon), namijenjenog operacijskim sustavima Fedora 13 i 14, otkrivena je sigurnosna ranjivost. Riječ je o programu koji se koristi kao sigurni FTP poslužitelj na sustavima UNIX/Linux. Ranjivost je posljedica pogreške u radu funkcije "vsf_filename_passes_filter()" u datoteci "ls.c". Udaljeni zlonamjerni korisnik može ju iskoristiti za izvođenje DoS napada. Svim korisnicima se savjetuje instalacija odgovarajućih sigurnosnih zakrpa.
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2011-2615
2011-03-04 09:41:28
--------------------------------------------------------------------------------
Name : vsftpd
Product : Fedora 13
Version : 2.3.4
Release : 1.fc13
URL : http://vsftpd.beasts.org/
Summary : Very Secure Ftp Daemon
Description :
vsftpd is a Very Secure FTP daemon. It was written completely from
scratch.
--------------------------------------------------------------------------------
ChangeLog:
* Thu Mar 3 2011 Jiri Skala <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 2.3.4-1
- update to latest upstream 2.3.4
- fixes #681935 - CVE-2011-0762 vsftpd: remote DoS via crafted glob pattern
* Mon May 17 2010 Jiri Skala <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 2.2.2-7
- when listen_ipv6=YES sets socket option to listen IPv6 only
* Fri May 14 2010 Jiri Skala <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 2.2.2-6
- syscall(__NR_clone) replaced by clone() to fix incorrect order of params on
s390 arch
* Wed Apr 7 2010 Jiri Skala <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 2.2.2-5
- corrected daemonize_plus patch - don't try kill parent when vsftpd isn't
daemonized
* Tue Mar 16 2010 Jiri Skala <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 2.2.2-4
- fixes #544251 - /etc/rc.d/init.d/vsftpd does not start more than one daemon
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #681667 - CVE-2011-0762 vsftpd: remote DoS via crafted glob
pattern
https://bugzilla.redhat.com/show_bug.cgi?id=681667
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update vsftpd' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
_______________________________________________
package-announce mailing list
Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.
https://admin.fedoraproject.org/mailman/listinfo/package-announce
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2011-2590
2011-03-04 09:40:33
--------------------------------------------------------------------------------
Name : vsftpd
Product : Fedora 14
Version : 2.3.4
Release : 1.fc14
URL : http://vsftpd.beasts.org/
Summary : Very Secure Ftp Daemon
Description :
vsftpd is a Very Secure FTP daemon. It was written completely from
scratch.
--------------------------------------------------------------------------------
ChangeLog:
* Thu Mar 3 2011 Jiri Skala <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 2.3.4-1
- update to latest upstream 2.3.4
- fixes #681935 - CVE-2011-0762 vsftpd: remote DoS via crafted glob pattern
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #681667 - CVE-2011-0762 vsftpd: remote DoS via crafted glob
pattern
https://bugzilla.redhat.com/show_bug.cgi?id=681667
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update vsftpd' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
_______________________________________________
package-announce mailing list
Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.
https://admin.fedoraproject.org/mailman/listinfo/package-announce
Posljednje sigurnosne preporuke