Login
Newsletter
Werbung

Sicherheit: Denial of Service in proftpd
Aktuelle Meldungen Distributionen
Name: Denial of Service in proftpd
ID: MDKSA-2006:217
Distribution: Mandriva
Plattformen: Mandriva Corporate 3.0, Mandriva 2006.0, Mandriva Corporate 4.0, Mandriva 2007.0
Datum: Mo, 20. November 2006, 23:33
Referenzen: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5815
Applikationen: ProFTPD

Originalnachricht

This is a multi-part message in MIME format...

------------=_1164061979-16192-2397


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDKSA-2006:217
http://www.mandriva.com/security/
_______________________________________________________________________

Package : proftpd
Date : November 20, 2006
Affected: 2006.0, 2007.0, Corporate 3.0, Corporate 4.0
_______________________________________________________________________

Problem Description:

As disclosed by an exploit (vd_proftpd.pm) and a related vendor bugfix,
a Denial of Service (DoS) vulnerability exists in the FTP server
ProFTPD, up to and including version 1.3.0. The flaw is due to both a
potential bus error and a definitive buffer overflow in the code which
determines the FTP command buffer size limit. The vulnerability can be
exploited only if the "CommandBufferSize" directive is explicitly used
in the server configuration, which is not the case in the default
configuration of ProFTPD.

Packages have been patched to correct these issues.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5815
_______________________________________________________________________

Updated Packages:

Mandriva Linux 2006.0:
0053ca9816e0bc25bccfe2f44d908eda
2006.0/i586/proftpd-1.2.10-13.2.20060mdk.i586.rpm
b01ed124f81f9f57c3217638f2b248fe
2006.0/i586/proftpd-anonymous-1.2.10-13.2.20060mdk.i586.rpm
0baf0a1757155c41e5a9748f3b5a2977
2006.0/SRPMS/proftpd-1.2.10-13.2.20060mdk.src.rpm

Mandriva Linux 2006.0/X86_64:
19c1348e2378d8e266543e9f411e7bec
2006.0/x86_64/proftpd-1.2.10-13.2.20060mdk.x86_64.rpm
0c61b1862cea2be964ec7117d3c1fa9e
2006.0/x86_64/proftpd-anonymous-1.2.10-13.2.20060mdk.x86_64.rpm
0baf0a1757155c41e5a9748f3b5a2977
2006.0/SRPMS/proftpd-1.2.10-13.2.20060mdk.src.rpm

Mandriva Linux 2007.0:
d1b46e09401cff86b5eb3cff5bb5d92d
2007.0/i586/proftpd-1.3.0-4.2mdv2007.0.i586.rpm
50dfa344357ea77649c760086d99efc5
2007.0/i586/proftpd-anonymous-1.3.0-4.2mdv2007.0.i586.rpm
ac4ffe2be045a45877c8ef5fca8aff82
2007.0/i586/proftpd-mod_autohost-1.3.0-4.2mdv2007.0.i586.rpm
a220594eecdf47d08047592dfc6ed989
2007.0/i586/proftpd-mod_case-1.3.0-4.2mdv2007.0.i586.rpm
ac8757c2cfda84be9340518730b2b0a9
2007.0/i586/proftpd-mod_clamav-1.3.0-4.2mdv2007.0.i586.rpm
a4e8f9e4399c3455586c0ad5ece2a9ba
2007.0/i586/proftpd-mod_ctrls_admin-1.3.0-4.2mdv2007.0.i586.rpm
6f3d1d596e634cbc725728606a220d74
2007.0/i586/proftpd-mod_facl-1.3.0-4.2mdv2007.0.i586.rpm
093f77c4bf48659600d2255a55d8c66a
2007.0/i586/proftpd-mod_gss-1.3.0-4.2mdv2007.0.i586.rpm
527188db7f7c0b6db43308823c7a245a
2007.0/i586/proftpd-mod_ifsession-1.3.0-4.2mdv2007.0.i586.rpm
3ad7759d27a44aafc84ef531c3ce0d83
2007.0/i586/proftpd-mod_ldap-1.3.0-4.2mdv2007.0.i586.rpm
70db19b073046a2baffe846c2287e00c
2007.0/i586/proftpd-mod_load-1.3.0-4.2mdv2007.0.i586.rpm
70416dbf2150fa2e29c9003cd9db627d
2007.0/i586/proftpd-mod_quotatab-1.3.0-4.2mdv2007.0.i586.rpm
62d8b7d49b89addb5a86962cf0efe210
2007.0/i586/proftpd-mod_quotatab_file-1.3.0-4.2mdv2007.0.i586.rpm
13431e876946f486a83e28d458e58e50
2007.0/i586/proftpd-mod_quotatab_ldap-1.3.0-4.2mdv2007.0.i586.rpm
4b95fe99c77ff967238ebf7c938c7d44
2007.0/i586/proftpd-mod_quotatab_sql-1.3.0-4.2mdv2007.0.i586.rpm
116be0e7b33ed3862408440e61a7827e
2007.0/i586/proftpd-mod_radius-1.3.0-4.2mdv2007.0.i586.rpm
00597f2284411df840d1d76c21d232a7
2007.0/i586/proftpd-mod_ratio-1.3.0-4.2mdv2007.0.i586.rpm
c57184424270ab38993930258ae4ef3a
2007.0/i586/proftpd-mod_rewrite-1.3.0-4.2mdv2007.0.i586.rpm
dcdabe501922432bfaa13e4520caee54
2007.0/i586/proftpd-mod_shaper-1.3.0-4.2mdv2007.0.i586.rpm
08f8675c360532db8679809c2df0a8bb
2007.0/i586/proftpd-mod_site_misc-1.3.0-4.2mdv2007.0.i586.rpm
5e7503e52019351d1eaef57e1e63ef9e
2007.0/i586/proftpd-mod_sql-1.3.0-4.2mdv2007.0.i586.rpm
6ba4cc9d229111078df98081f0821600
2007.0/i586/proftpd-mod_sql_mysql-1.3.0-4.2mdv2007.0.i586.rpm
ec5429aaf01a432eeb4cc6ccfcf9183f
2007.0/i586/proftpd-mod_sql_postgres-1.3.0-4.2mdv2007.0.i586.rpm
dde8bc68edac5463601886b53756c402
2007.0/i586/proftpd-mod_time-1.3.0-4.2mdv2007.0.i586.rpm
133560087f64cfa06b765cfda2b24780
2007.0/i586/proftpd-mod_tls-1.3.0-4.2mdv2007.0.i586.rpm
eef642bb96557634370d24e040a3e3fd
2007.0/i586/proftpd-mod_wrap-1.3.0-4.2mdv2007.0.i586.rpm
14f19ba95138a85a53c17173e006552f
2007.0/i586/proftpd-mod_wrap_file-1.3.0-4.2mdv2007.0.i586.rpm
7a4ef558e014459382192aeac06a0bf6
2007.0/i586/proftpd-mod_wrap_sql-1.3.0-4.2mdv2007.0.i586.rpm
997d5a11fe5fca5c7f04f5fe425a58b9
2007.0/SRPMS/proftpd-1.3.0-4.2mdv2007.0.src.rpm

Mandriva Linux 2007.0/X86_64:
3b99b5f2a9edd6a5d05ade87a73db307
2007.0/x86_64/proftpd-1.3.0-4.2mdv2007.0.x86_64.rpm
817e2d8131bb3fa9e47d98324ddac5c6
2007.0/x86_64/proftpd-anonymous-1.3.0-4.2mdv2007.0.x86_64.rpm
d204a009c383529ed13c7599979c499d
2007.0/x86_64/proftpd-debug-1.3.0-4.2mdv2007.0.x86_64.rpm
299328a3ef758215995bc2b228ec0b3f
2007.0/x86_64/proftpd-mod_autohost-1.3.0-4.2mdv2007.0.x86_64.rpm
cd85e8a8042d8840b44660b980879859
2007.0/x86_64/proftpd-mod_case-1.3.0-4.2mdv2007.0.x86_64.rpm
876c823f55cc56328c1cf6cc4c88ac96
2007.0/x86_64/proftpd-mod_clamav-1.3.0-4.2mdv2007.0.x86_64.rpm
976fb7efc64eb1d96ba6dbe35a698471
2007.0/x86_64/proftpd-mod_ctrls_admin-1.3.0-4.2mdv2007.0.x86_64.rpm
545f2c9ee7cdd13132fdbaa6c4be63b9
2007.0/x86_64/proftpd-mod_facl-1.3.0-4.2mdv2007.0.x86_64.rpm
6f8c16234f9c9c08e332aaf91d74489f
2007.0/x86_64/proftpd-mod_gss-1.3.0-4.2mdv2007.0.x86_64.rpm
d2f5795181c4e7b43f92fc5ae0ce3ab6
2007.0/x86_64/proftpd-mod_ifsession-1.3.0-4.2mdv2007.0.x86_64.rpm
fbbb100387e43c1fd879c4da1502393a
2007.0/x86_64/proftpd-mod_ldap-1.3.0-4.2mdv2007.0.x86_64.rpm
9e41369b4fb53d33df4568c19728bd30
2007.0/x86_64/proftpd-mod_load-1.3.0-4.2mdv2007.0.x86_64.rpm
4498f75ddf6f54736cda5d435999ade8
2007.0/x86_64/proftpd-mod_quotatab-1.3.0-4.2mdv2007.0.x86_64.rpm
5098bfb4b07b68f673ce2988656e5027
2007.0/x86_64/proftpd-mod_quotatab_file-1.3.0-4.2mdv2007.0.x86_64.rpm
3395c4202286675cef765b600c50a9d9
2007.0/x86_64/proftpd-mod_quotatab_ldap-1.3.0-4.2mdv2007.0.x86_64.rpm
5eebf72bcecb15b91368abe57ca5e33f
2007.0/x86_64/proftpd-mod_quotatab_sql-1.3.0-4.2mdv2007.0.x86_64.rpm
1144a84050daef248645ef7af0f92995
2007.0/x86_64/proftpd-mod_radius-1.3.0-4.2mdv2007.0.x86_64.rpm
b917bf18c26150aa240e3afbbcf0b2f1
2007.0/x86_64/proftpd-mod_ratio-1.3.0-4.2mdv2007.0.x86_64.rpm
a06fe91a4a37f5e403e1e58b05591724
2007.0/x86_64/proftpd-mod_rewrite-1.3.0-4.2mdv2007.0.x86_64.rpm
8ce4fe2a4a4558f0925d479d67400137
2007.0/x86_64/proftpd-mod_shaper-1.3.0-4.2mdv2007.0.x86_64.rpm
1b8d0e93191bcbc3f32c09cc00eb9155
2007.0/x86_64/proftpd-mod_site_misc-1.3.0-4.2mdv2007.0.x86_64.rpm
548a2acaeba3bd5840c3ff7aacd2574c
2007.0/x86_64/proftpd-mod_sql-1.3.0-4.2mdv2007.0.x86_64.rpm
a7a8731b55ad81410c91b4a0559068ed
2007.0/x86_64/proftpd-mod_sql_mysql-1.3.0-4.2mdv2007.0.x86_64.rpm
18f8a27c84d8d62437c40bd1828d78b0
2007.0/x86_64/proftpd-mod_sql_postgres-1.3.0-4.2mdv2007.0.x86_64.rpm
a0e81004cde841dd8cf826eed6fb3225
2007.0/x86_64/proftpd-mod_time-1.3.0-4.2mdv2007.0.x86_64.rpm
90298f22556f11f1e42488b87de37773
2007.0/x86_64/proftpd-mod_tls-1.3.0-4.2mdv2007.0.x86_64.rpm
f3fa5fe3b33fae484b35dd0368dcf00f
2007.0/x86_64/proftpd-mod_wrap-1.3.0-4.2mdv2007.0.x86_64.rpm
064fb39be6c6f5326e20ed9d881cebf7
2007.0/x86_64/proftpd-mod_wrap_file-1.3.0-4.2mdv2007.0.x86_64.rpm
e3871e76aed8d19fa548ee8641138076
2007.0/x86_64/proftpd-mod_wrap_sql-1.3.0-4.2mdv2007.0.x86_64.rpm
997d5a11fe5fca5c7f04f5fe425a58b9
2007.0/SRPMS/proftpd-1.3.0-4.2mdv2007.0.src.rpm

Corporate 3.0:
1a83657627d6f218ae54f8b2c45fbd79
corporate/3.0/i586/proftpd-1.2.9-3.5.C30mdk.i586.rpm
70e1eb731cfe7c8cb555a1eabc4bc4a3
corporate/3.0/i586/proftpd-anonymous-1.2.9-3.5.C30mdk.i586.rpm
1d7d9073cd0debaea27401a45bf24fbc
corporate/3.0/SRPMS/proftpd-1.2.9-3.5.C30mdk.src.rpm

Corporate 3.0/X86_64:
41b6f448e1354f9589beee850f491f50
corporate/3.0/x86_64/proftpd-1.2.9-3.5.C30mdk.x86_64.rpm
615446968808ac110d05aecfe3dbabd5
corporate/3.0/x86_64/proftpd-anonymous-1.2.9-3.5.C30mdk.x86_64.rpm
1d7d9073cd0debaea27401a45bf24fbc
corporate/3.0/SRPMS/proftpd-1.2.9-3.5.C30mdk.src.rpm

Corporate 4.0:
633aefd9b99b8c2879c0edf256b47d7a
corporate/4.0/i586/proftpd-1.2.10-20.2.20060mlcs4.i586.rpm
edaf7462323b66dd57860f03e98c4795
corporate/4.0/i586/proftpd-anonymous-1.2.10-20.2.20060mlcs4.i586.rpm
79c119bdf57238b11f3b92882c1c0e75
corporate/4.0/SRPMS/proftpd-1.2.10-20.2.20060mlcs4.src.rpm

Corporate 4.0/X86_64:
f135f65d15347fe5f6b72d00b93964e7
corporate/4.0/x86_64/proftpd-1.2.10-20.2.20060mlcs4.x86_64.rpm
5e25ac25c11105ca94f5a9aa2dd4dafc
corporate/4.0/x86_64/proftpd-anonymous-1.2.10-20.2.20060mlcs4.x86_64.rpm
79c119bdf57238b11f3b92882c1c0e75
corporate/4.0/SRPMS/proftpd-1.2.10-20.2.20060mlcs4.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)

iD8DBQFFYf3ymqjQ0CJFipgRAvcRAJ91oK3DHG1R+twQlhUHjwRE2Kg/WACcC7sV
1GR8XH6WF+J7S1rz3go/LRo=
=NoMr
-----END PGP SIGNATURE-----


------------=_1164061979-16192-2397
Content-Type: text/plain; name="message-footer.txt"
Content-Disposition: inline; filename="message-footer.txt"
Content-Transfer-Encoding: 8bit

To unsubscribe, send a email to sympa@mandrivalinux.org
with this subject : unsubscribe security-announce
_______________________________________________________
Want to buy your Pack or Services from Mandriva?
Go to http://www.mandrivastore.com
Join the Club : http://www.mandrivaclub.com
_______________________________________________________

------------=_1164061979-16192-2397--
Pro-Linux
Frohe Ostern
Neue Nachrichten
Werbung