[SECURITY] Fedora 12 Update: proftpd-1.3.2c-1.fc12

updates at fedoraproject.org updates at fedoraproject.org
Sun Dec 27 20:24:34 UTC 2009


--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2009-13250
2009-12-16 00:20:38
--------------------------------------------------------------------------------

Name        : proftpd
Product     : Fedora 12
Version     : 1.3.2c
Release     : 1.fc12
URL         : http://www.proftpd.org/
Summary     : Flexible, stable and highly-configurable FTP server
Description :
ProFTPD is an enhanced FTP server with a focus toward simplicity, security,
and ease of configuration. It features a very Apache-like configuration
syntax, and a highly customizable server infrastructure, including support for
multiple 'virtual' FTP servers, anonymous FTP, and permission-based directory
visibility.

This package defaults to the standalone behaviour of ProFTPD, but all the
needed scripts to have it run by xinetd instead are included.

--------------------------------------------------------------------------------
Update Information:

This update addresses CVE-2009-3555 (SSL/TLS renegotiation vulnerability),
mitigating the problem by refusing all client-initiated SSL/TLS session
renegotiations.    This update to the latest maintenance release also fixes a
number of bugs recorded in the proftpd bug tracker:    - SSL/TLS renegotiation
vulnerability (CVE-2009-3555, bug 3324)  - Failed database transaction can cause
mod_quotatab to loop (bug 3228)  - Segfault in mod_wrap (bug 3332)  -
<Directory> sections can have <Limit> problems (bug 3337)  - mod_wrap2 segfaults
when a valid user retries the USER command (bug 3341)  - mod_auth_file handles
'getgroups' request incorrectly (bug 3347)  - Segfault caused by scrubbing zero-
length portion of memory (bug 3350)    Finally, the behaviour of the MLSD FTP
command (used in many modern FTP clients to list directories) is fixed for the
case when the FTP server's configuration disallows its usage (using a <Limit>
clause) in some but not all places (#544002).
--------------------------------------------------------------------------------
ChangeLog:

* Thu Dec 10 2009 Paul Howarth <paul at city-fan.org> 1.3.2c-1
- Update to 1.3.2c, addressing the following issues:
  - SSL/TLS renegotiation vulnerability (CVE-2009-3555, bug 3324)
  - Failed database transaction can cause mod_quotatab to loop (bug 3228)
  - Segfault in mod_wrap (bug 3332)
  - <Directory> sections can have <Limit> problems (bug 3337)
  - mod_wrap2 segfaults when a valid user retries the USER command (bug 3341)
  - mod_auth_file handles 'getgroups' request incorrectly (bug 3347)
  - Segfault caused by scrubbing zero-length portion of memory (bug 3350)
- Drop upstreamed segfault patch
* Thu Dec 10 2009 Paul Howarth <paul at city-fan.org> 1.3.2b-3
- Add patch for upstream bug 3350 - segfault on auth failures
* Wed Dec  9 2009 Paul Howarth <paul at city-fan.org> 1.3.2b-2
- Reduce the mod_facts patch to the single commit addressing the issue with
  directory names with glob characters (#521634), avoiding introducing a
  further problem with <Limit> (#544002)
--------------------------------------------------------------------------------
References:

  [ 1 ] Bug #533125 - CVE-2009-3555 TLS: MITM attacks via session renegotiation
        https://bugzilla.redhat.com/show_bug.cgi?id=533125
--------------------------------------------------------------------------------

This update can be installed with the "yum" update program.  Use 
su -c 'yum update proftpd' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.

All packages are signed with the Fedora Project GPG key.  More details on the
GPG keys used by the Fedora Project can be found at
http://fedoraproject.org/keys
--------------------------------------------------------------------------------




More information about the Fedora-package-announce mailing list