bugtraq - TSLSA-2006-0066

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <20061128073846.GA3061@tsunami.trustix.net>
Date: Tue, 28 Nov 2006 07:38:46 +0000
From: Trustix Security Advisor <tsl@...stix.org>
To: bugtraq@...urityfocus.com
Subject: TSLSA-2006-0066 - multi

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- --------------------------------------------------------------------------
Trustix Secure Linux Security Advisory #2006-0066

Package names:	   openldap, proftpd
Summary:           Multiple vulnerabilities
Date:              2006-11-28
Affected versions: Trustix Secure Linux 2.2
                   Trustix Secure Linux 3.0
                   Trustix Operating System - Enterprise Server 2

- --------------------------------------------------------------------------
Package description:
  openldap
  OpenLDAP is an open-source suite of LDAP (Lightweight Directory Access
  Protocol) applications and development tools. LDAP is a set of
  protocols for accessing directory services (usually phone book style
  information, but other information is possible) over the Internet,
  similar to the way DNS (Domain Name System) information is propagated
  over the Internet. This package contains the slapd and slurpd servers,
  migration scripts, and related files.

  proftpd
  ProFTPd is an enhanced FTP server with a focus toward simplicity,
  security, and ease of configuration. It features a very Apache-like
  configuration syntax, and a highly customizable server infrastructure,
  including support for multiple 'virtual' FTP servers, anonymous FTP,
  and permission-based directory visibility.

Problem description:
  openldap  < TSL 3.0 > < TSL 2.2 > < TSEL 2 >
  - SECURITY Fix: Evgeny Legerov has reported a vulnerability in
    OpenLDAP, caused due to an error when processing certain BIND
    requests. This can be exploited to cause a crash by sending specially
    crafted BIND requests to an OpenLDAP server.

    The Common Vulnerabilities and Exposures project has assigned the
    name CVE-2006-5779 to this issue.

  proftpd < TSL 3.0 > < TSL 2.2 > < TSEL 2 >
  - SECURITY Fix: Evgeny Legerov has reported a vulnerability in ProFTPD,
    caused due to a buffer overflow error in the "main.c" file where the
    "cmd_buf_size" size of the buffer used to handle FTP commands sent
    by clients is not properly set to the size configured via the
    "CommandBufferSize" directive. This can be exploited by malicious
    people to compromise a vulnerable system.

    The Common Vulnerabilities and Exposures project (cve.mitre.org)
    has assigned the name CVE-2006-5815 to this issue.
  - Security fix in mod_tls.
 
Action:
  We recommend that all systems with this package installed be upgraded.
  Please note that if you do not need the functionality provided by this
  package, you may want to remove it from your system.


Location:
  All Trustix Secure Linux updates are available from
  <URI:http://http.trustix.org/pub/trustix/updates/>
  <URI:ftp://ftp.trustix.org/pub/trustix/updates/>


About Trustix Secure Linux:
  Trustix Secure Linux is a small Linux distribution for servers. With focus
  on security and stability, the system is painlessly kept safe and up to
  date from day one using swup, the automated software updater.


Automatic updates:
  Users of the SWUP tool can enjoy having updates automatically
  installed using 'swup --upgrade'.


Questions?
  Check out our mailing lists:
  <URI:http://www.trustix.org/support/>


Verification:
  This advisory along with all Trustix packages are signed with the
  TSL sign key.
  This key is available from:
  <URI:http://www.trustix.org/TSL-SIGN-KEY>

  The advisory itself is available from the errata pages at
  <URI:http://www.trustix.org/errata/trustix-2.2/> and
  <URI:http://www.trustix.org/errata/trustix-3.0/>
  or directly at
  <URI:http://www.trustix.org/errata/2006/0066/>


MD5sums of the packages:
- --------------------------------------------------------------------------
f13bcc4d373d7af3945bbe23da21ba07  3.0/rpms/openldap-2.2.27-4tr.i586.rpm
f22f61307123faed3afe09eb9fc4b557  3.0/rpms/openldap-devel-2.2.27-4tr.i586.rpm
af3a00c321962082fc0d4f640f8e2550  3.0/rpms/openldap-libs-2.2.27-4tr.i586.rpm
2b6c9d0c3b2a7400091c32a6c43b63dd  3.0/rpms/openldap-servers-2.2.27-4tr.i586.rpm
845ea741f8592807c6c3fb0b2f20a7fa  3.0/rpms/openldap-utils-2.2.27-4tr.i586.rpm
9ccb3b101a29f535d8b9f03bb32da9e8  3.0/rpms/proftpd-1.3.0-3tr.i586.rpm

9276c628f10a30216dbf66ede6f241a5  2.2/rpms/openldap-2.1.30-7tr.i586.rpm
2c3f290caf04262f4b73d4e68d9e8da2  2.2/rpms/openldap-devel-2.1.30-7tr.i586.rpm
fa0857dcf95b51f5e95eac89fc8ce686  2.2/rpms/openldap-libs-2.1.30-7tr.i586.rpm
b25f676b33591a8d915ef66409ee65b8  2.2/rpms/openldap-servers-2.1.30-7tr.i586.rpm
de7b3cb63cede912babe1bcac41a8a2e  2.2/rpms/openldap-utils-2.1.30-7tr.i586.rpm
37f1f8032fe88b2b09b181bdca0f362f  2.2/rpms/proftpd-1.2.10-11tr.i586.rpm
- --------------------------------------------------------------------------


Trustix Security Team


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (GNU/Linux)

iD8DBQFFa+YBi8CEzsK9IksRAlpYAJ94MSfvif2jqcI5yMcgrNoAcGIgAACguykb
C45tIefHO22+/BLrrlWIc7Y=
=Vneq
-----END PGP SIGNATURE-----