bugtraq - TSLSA-2005-0040

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Fri, 5 Aug 2005 18:49:46 +0200
From: Trustix Security Advisor <tsl@...stix.org>
To: bugtraq@...urityfocus.com
Subject: TSLSA-2005-0040 - multi


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- --------------------------------------------------------------------------
Trustix Secure Linux Security Advisory #2005-0040

Package names:     bzip2, perl-compress-zlib, proftpd
Summary:           Multiple vulnerabilities
Date:              2005-08-05
Affected versions: Trustix Secure Linux 2.2
                   Trustix Secure Linux 3.0
                   Trustix Operating System - Enterprise Server 2

- --------------------------------------------------------------------------
Package description:
  bzip2
  Bzip2 is a freely available, patent-free, high quality data compressor.
  Bzip2 compresses files to within 10 to 15 percent of the capabilities
  of the best techniques available.  However, bzip2 has the added benefit
  of being approximately two times faster at compression and six times
  faster at decompression than those techniques.  Bzip2 is not the
  fastest compression utility, but it does strike a balance between speed
  and compression capability.

  perl-compress-zlib
  Compress-Zlib module from CPAN for perl

  proftpd
  ProFTPd is an enhanced FTP server with a focus toward simplicity,
  security, and ease of configuration.  It features a very Apache-like
  configuration syntax, and a highly customizable server infrastructure,
  including support for multiple 'virtual' FTP servers, anonymous FTP, and
  permission-based directory visibility.


Problem description:
  bzip2
  - SECURITY Fix: Command injection vulnerability in the "bzgrep"
  - bzgrep did not handle shell metacharacters like '|' and '&' properly
    when they occurred in input file names. This could be exploited to
    execute arbitrary commands with user privileges if bzgrep was run in
    an untrusted directory with specially crafted file names.

    The Common Vulnerabilities and Exposures project (cve.mitre.org)
    has assigned the name CAN-2005-0758 to this issue.

  perl-compress-zlib
  - New upstream.
  - SECURITY Fix: Previous version of Compress::Zlib contains a local
    vulnerable version of zlib, which may lead to a buffer overflow.
    (CAN-2005-1849).

  proftpd
  - SECURITY Fix: Format string vulnerabilities
  - Two vulnerabilities have been reported in ProFTPD, which can be
    exploited by malicious users to disclose certain sensitive
    information, cause a DoS (Denial of Service), or potentially
    compromise a vulnerable system.

    The Common Vulnerabilities and Exposures project (cve.mitre.org)
    has assigned the name CAN-2005-2390 to this issue.

Action:
  We recommend that all systems with this package installed be upgraded.
  Please note that if you do not need the functionality provided by this
  package, you may want to remove it from your system.


Location:
  All Trustix Secure Linux updates are available from
  <URI:http://http.trustix.org/pub/trustix/updates/>
  <URI:ftp://ftp.trustix.org/pub/trustix/updates/>


About Trustix Secure Linux:
  Trustix Secure Linux is a small Linux distribution for servers. With focus
  on security and stability, the system is painlessly kept safe and up to
  date from day one using swup, the automated software updater.


Automatic updates:
  Users of the SWUP tool can enjoy having updates automatically
  installed using 'swup --upgrade'.


Questions?
  Check out our mailing lists:
  <URI:http://www.trustix.org/support/>


Verification:
  This advisory along with all Trustix packages are signed with the
  TSL sign key.
  This key is available from:
  <URI:http://www.trustix.org/TSL-SIGN-KEY>

  The advisory itself is available from the errata pages at
  <URI:http://www.trustix.org/errata/trustix-2.2/> and
  <URI:http://www.trustix.org/errata/trustix-3.0/>
  or directly at
  <URI:http://www.trustix.org/errata/2005/0040/>


MD5sums of the packages:
- --------------------------------------------------------------------------
c57a14ddc70dc381eea83b48d2698f22  3.0/rpms/bzip2-1.0.3-4tr.i586.rpm
3ad903577196558e5ce8efd602752257  3.0/rpms/bzip2-devel-1.0.3-4tr.i586.rpm
6bf458dd6edad3086a0c122e80f179cd  3.0/rpms/bzip2-libs-1.0.3-4tr.i586.rpm
fce91bc96bb5716a8518ec9c32e9d406  3.0/rpms/perl-compress-zlib-1.35-1tr.i586.rpm
b8a15769fa994e12a9416180fc01c495  3.0/rpms/proftpd-1.2.10-9tr.i586.rpm

114904521848d54ea07c8225d05c4e2e  2.2/rpms/bzip2-1.0.3-3tr.i586.rpm
21410bd75ce00fe486080777c0ba95f8  2.2/rpms/bzip2-devel-1.0.3-3tr.i586.rpm
bb79cd2198cc9a323639ff6188cd5fd9  2.2/rpms/bzip2-libs-1.0.3-3tr.i586.rpm
5a9be0817c3fb7aea5a74e62051edb74  2.2/rpms/perl-compress-zlib-1.35-1tr.i586.rpm
1b12b65524f9c4caa88523c81388853a  2.2/rpms/proftpd-1.2.10-9tr.i586.rpm
- --------------------------------------------------------------------------

Trustix Security Team

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFC85ahi8CEzsK9IksRArGxAKCpE2L7xpuqtydUUziV+uceT3YtKQCff/GD
+NtJ9EdUZADkzxlQfjMx0dU=
=0aeZ
-----END PGP SIGNATURE-----