SecurityFocus BUGTRAQ Mailing List: BugTraqLink Number One Link Number One Link Number Two Link Number Two Link Number One Link Number One Link Number Two Link Number Two Entire Site Advisories Calendar Columnists Elsewhere Guest Feature Infocus Library Links Mailing Lists (all) -- BUGTRAQ -- FOCUS-IDS -- FOCUS-IH -- FOCUS-LINUX -- FOCUS-MS -- FOCUS-SUN -- FOCUS-VIRUS -- FORENSICS -- INCIDENTS -- PEN-TEST -- SEC JOBS -- SF NEWS -- VULN-DEV News Products Services Tools Vulns BUGTRAQ ARCHIVE [ Message Index ] [ Thread Index ][ Reply ] [ prev Msg by Date ][ next Msg by Date ] To: BugTraq Subject: [CLA-2003:750] Conectiva Security Announcement - proftpd Date: Sep 29 2003 6:07PM Author: Conectiva Updates Message-ID: <200309291807.PAA18861@frajuto.distro.conectiva> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- CONECTIVA LINUX SECURITY ANNOUNCEMENT - -------------------------------------------------------------------------- PACKAGE : proftpd SUMMARY : Remote vulnerability DATE : 2003-09-29 15:03:00 ID : CLA-2003:750 RELEVANT RELEASES : 9 - ------------------------------------------------------------------------- DESCRIPTION ProFTPD is a highly configurable FTP daemon written from scratch for Unix and Unix-like operating systems. ISS X-Force has discovered a vulnerability[1] in the way proftpd (versions >= 1.2.7) handles incoming ASCII file transfers. An attacker who is able to upload and download the same file can exploit this vulnerability to execute arbitrary code with root privileges. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2003-0831 to this issue[2]. SOLUTION All proftpd users should upgrade. Please note that after the upgrade the proftpd process will be automatically restarted if it is already running. It is recommended that administrators shut down all current connections (which will be using the vulnerable copy) to avoid a possible abuse by currently connected users. REFERENCES: 1.http://xforce.iss.net/xforce/alerts/id/154 2.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0831 UPDATED PACKAGES ftp://atualizacoes.conectiva.com.br/9/RPMS/proftpd-1.2.7-27285U90_2cl.i386.rpm ftp://atualizacoes.conectiva.com.br/9/RPMS/proftpd-doc-1.2.7-27285U90_2cl.i386.rpm ftp://atualizacoes.conectiva.com.br/9/SRPMS/proftpd-1.2.7-27285U90_2cl.src.rpm ADDITIONAL INSTRUCTIONS The apt tool can be used to perform RPM packages upgrades: - run: apt-get update - after that, execute: apt-get upgrade Detailed instructions reagarding the use of apt and upgrade examples can be found at http://distro.conectiva.com.br/atualizacoes/#apt?idioma=en - ------------------------------------------------------------------------- All packages are signed with Conectiva's GPG key. The key and instructions on how to import it can be found at http://distro.conectiva.com.br/seguranca/chave/?idioma=en Instructions on how to check the signatures of the RPM packages can be found at http://distro.conectiva.com.br/seguranca/politica/?idioma=en - ------------------------------------------------------------------------- All our advisories and generic update instructions can be viewed at http://distro.conectiva.com.br/atualizacoes/?idioma=en - ------------------------------------------------------------------------- Copyright (c) 2003 Conectiva Inc. http://www.conectiva.com - ------------------------------------------------------------------------- subscribe: conectiva-updates-subscribe papaleguas conectiva com br unsubscribe: conectiva-updates-unsubscribe papaleguas conectiva com br -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE/eHTH42jd0JmAcZARAh5tAKChQTcRaVx0ICYbpq8WLDGX4QX4VQCfQcNb ljCGtABbsBmaoiEyYl1WqCo= =fIE3 -----END PGP SIGNATURE----- Want to link to this message? Use this URL: Disclaimer, Terms & Conditions About this List Featured Lists: ARIS Users bugtraq bugtraq-es bugtraq-french NEW bugtraq-jp firewalls focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics forensics-es honeypots incidents libnet pen-test secevents secpapers secprog sectools secureshell security-basics security-management NEW securityjobs vpn vuln-dev webappsec Newsletters: sf-news ms-secnews linux-secnews [ more . . . ] Privacy Statement Copyright © 1999-2003 SecurityFocus