SecurityFocus BUGTRAQ Mailing List: BugTraqLink Number One Link Number One Link 
Number Two Link Number Two  Link Number One Link Number One Link Number Two Link 
Number Two   
                          Entire Site Advisories Calendar Columnists Elsewhere 
                          Guest Feature Infocus Library Links Mailing Lists 
                          (all) -- BUGTRAQ -- FOCUS-IDS -- FOCUS-IH -- 
                          FOCUS-LINUX -- FOCUS-MS -- FOCUS-SUN -- FOCUS-VIRUS -- 
                          FORENSICS -- INCIDENTS -- PEN-TEST -- SEC JOBS -- SF 
                          NEWS -- VULN-DEV News Products Services Tools Vulns








             
             




                         BUGTRAQ ARCHIVE 

                        [ Message Index ] [ Thread Index ][ Reply ]
                        [ prev Msg by Date ][ next Msg by Date ]


                              To: BugTraq
                              Subject: TSLSA-2003-0037 - proftpd
                              Date: Sep 29 2003 2:19AM
                              Author: Trustix Secure Linux Advisor <tsl trustix 
                              com>
                              Message-ID: 
                              <20030929021948.GA2268@forecast.trustix.com>


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- --------------------------------------------------------------------------
Trustix Secure Linux Security Advisory #2003-0037

Package name:      proftpd
Summary:           remote exploit if upload enabled
Date:              2003-09-27
Affected versions: TSL 1.2, 1.5, 2.0

- --------------------------------------------------------------------------
Package description:
  ProFTPd is an enhanced FTP server with a focus toward simplicity,
  security, and ease of configuration.  It features a very Apache-like
  configuration syntax, and a highly customizable server infrastructure,
  including support for multiple 'virtual' FTP servers, anonymous FTP, and
  permission-based directory visibility.


Problem description:
  An error exists in the ASCII upload handling of Proftpd version 1.2.7
  and later that can be used to trigger an buffer overflow and thus
  execute arbitrary code.  This has now been fixed.

Action:
  We recommend that all systems with this package installed be upgraded.
  Please note that if you do not need the functionality provided by this
  package, you may want to remove it from your system.


Location:
  All TSL updates are available from
  <URI:http://www.trustix.net/pub/Trustix/updates/>
  <URI:ftp://ftp.trustix.net/pub/Trustix/updates/>


About Trustix Secure Linux:
  Trustix Secure Linux is a small Linux distribution for servers. With focus
  on security and stability, the system is painlessly kept safe and up to
  date from day one using swup, the automated software updater.


Automatic updates:
  Users of the SWUP tool can enjoy having updates automatically
  installed using 'swup --upgrade'.


Public testing:
  These packages have been available for public testing for some time.
  If you want to contribute by testing the various packages in the
  testing tree, please feel free to share your findings on the
  tsl-discuss mailinglist.
  The testing tree is located at
  <URI:http://www.trustix.net/pub/Trustix/testing/>
  <URI:ftp://ftp.trustix.net/pub/Trustix/testing/>

  You may also use swup for public testing of updates for TSL 2.0 and later:
  
  site {
      class = 0
      location = "http://snow.trustix.org/cloud/rdfs/latest.rdf"
      regexp = ".*"
  }
  

Questions?
  Check out our mailing lists:
  <URI:http://www.trustix.net/support/>


Verification:
  This advisory along with all TSL packages are signed with the TSL sign key.
  This key is available from:
  <URI:http://www.trustix.net/TSL-GPG-KEY>

  The advisory itself is available from the errata pages at
  <URI:http://www.trustix.net/errata/trustix-1.2/>,
  <URI:http://www.trustix.net/errata/trustix-1.5/> and
  <URI:http://www.trustix.net/errata/trustix-2.0/>
  or directly at
  <URI:http://www.trustix.net/errata/misc/2003/TSL-2003-0037-proftpd.asc.txt>


MD5sums of the packages:
- --------------------------------------------------------------------------
429165d5e6335e8ee002184ae91d3fa9  ./1.2/RPMS/proftpd-1.2.8-10tr.i586.rpm
ffc555898ba64d98ccdbc63965ebb5b8  ./1.2/SRPMS/proftpd-1.2.8-10tr.src.rpm
0f8bb15841f731d1e8871d2c12736680  ./1.5/RPMS/proftpd-1.2.8-10tr.i586.rpm
ffc555898ba64d98ccdbc63965ebb5b8  ./1.5/SRPMS/proftpd-1.2.8-10tr.src.rpm
6656d385bc41273678a4b426fb4ba2db  ./2.0/RPMS/proftpd-1.2.8-9tr.i586.rpm
842153ad2b1a982568af28c5be0ff2be  ./2.0/SRPMS/proftpd-1.2.8-9tr.src.rpm
- --------------------------------------------------------------------------


Trustix Security Team

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (GNU/Linux)

iD8DBQE/d4s4wRTcg4BxxS0RApmLAJ9aIc0mGD+EnkcUidG4ELy/l231LACfTu4u
V4Mm+20WMFg18KhTVn42Vlg=
=T2SV
-----END PGP SIGNATURE-----





                  Want to link to this message? Use this URL: 
                  <http://www.securityfocus.com/archive/1/339458>
                  Disclaimer, Terms & Conditions


                  About this List


                  Featured Lists:

                  ARIS Users
                  bugtraq
                  bugtraq-es
                  bugtraq-french NEW
                  bugtraq-jp
                  firewalls
                  focus-ids
                  focus-ih
                  focus-linux
                  focus-ms
                  focus-sun
                  focus-unix-other
                  focus-virus
                  forensics
                  forensics-es
                  honeypots
                  incidents
                  libnet
                  pen-test
                  secevents
                  secpapers
                  secprog
                  sectools
                  secureshell
                  security-basics
                  security-management NEW
                  securityjobs
                  vpn
                  vuln-dev
                  webappsec

                  Newsletters:

                  sf-news
                  ms-secnews
                  linux-secnews


                  [ more . . . ]




                        Privacy Statement
                        Copyright © 1999-2003 SecurityFocus