To: bugtraq@securityfocus.com
Subject: [ MDKSA-2006:217-2 ] - Updated proftpd packages fix vulnerabilities
Date: Tue, 23 Jan 2007 16:06:35 -0700
From: security@mandriva.com
Reply-To: <xsecurity@mandriva.com.>
Message-Id: <E1H9Uip-0001cL-Nk@artemis.annvix.ca.>
Sender: QA Team <qateam@artemis.annvix.ca.>
X-Virus-Scanned: antivirus-gw at tyumen.ru
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDKSA-2006:217-2
http://www.mandriva.com/security/
_______________________________________________________________________
Package : proftpd
Date : January 23, 2007
Affected: Corporate 3.0
_______________________________________________________________________
Problem Description:
A stack-based buffer overflow in the sreplace function in ProFTPD 1.3.0
and earlier, allows remote attackers to cause a denial of service, as
demonstrated by vd_proftpd.pm, a "ProFTPD remote exploit."
(CVE-2006-5815)
Buffer overflow in the tls_x509_name_oneline function in the mod_tls
module, as used in ProFTPD 1.3.0a and earlier, and possibly other
products, allows remote attackers to execute arbitrary code via a large
data length argument, a different vulnerability than CVE-2006-5815.
(CVE-2006-6170)
ProFTPD 1.3.0a and earlier does not properly set the buffer size limit
when CommandBufferSize is specified in the configuration file, which
leads to an off-by-two buffer underflow. NOTE: in November 2006, the
role of CommandBufferSize was originally associated with CVE-2006-5815,
but this was an error stemming from an initial vague disclosure. NOTE:
ProFTPD developers dispute this issue, saying that the relevant memory
location is overwritten by assignment before further use within the
affected function, so this is not a vulnerability. (CVE-2006-6171)
Packages have been patched to correct these issues.
Update:
The update for the Corporate 3.0 platforms had a bad patch for
CVE-2006-5815, which prevented some clients from being able to use the
server. This update corrects this issue.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5815http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6170http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6171
_______________________________________________________________________
Updated Packages:
Corporate 3.0:
98a60448e690842a0afe6cb50925ceeb corporate/3.0/i586/proftpd-1.2.9-3.7.C30mdk.i586.rpm
9aee57777e7d355fa8b730a79f4a58df corporate/3.0/i586/proftpd-anonymous-1.2.9-3.7.C30mdk.i586.rpm
1cf5d2e63700ee924b0346bdd72505d9 corporate/3.0/SRPMS/proftpd-1.2.9-3.7.C30mdk.src.rpm
Corporate 3.0/X86_64:
a3baa6cdea37f84a99c24b4c3c681ca6 corporate/3.0/x86_64/proftpd-1.2.9-3.7.C30mdk.x86_64.rpm
de981e7a4a3eec5371a31079c50d5c17 corporate/3.0/x86_64/proftpd-anonymous-1.2.9-3.7.C30mdk.x86_64.rpm
1cf5d2e63700ee924b0346bdd72505d9 corporate/3.0/SRPMS/proftpd-1.2.9-3.7.C30mdk.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
iD8DBQFFtmozmqjQ0CJFipgRAhtpAKCWjInDTsN+klJssg25l46lYy3TGwCgrFLL
eC5oR5Z7A0UFcICGSPfmnJo=
=/+m9
-----END PGP SIGNATURE-----
