bugtraq - [SECURITY] [DSA 1245-1] New proftpd packages fix denial of service

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <20070107123349.GA4900@galadriel.inutil.org>
Date: Sun, 7 Jan 2007 13:33:49 +0100
From: Moritz Muehlenhoff <jmm@...ian.org>
To: bugtraq@...urityfocus.com
Subject: [SECURITY] [DSA 1245-1] New proftpd packages fix denial of service

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- --------------------------------------------------------------------------
Debian Security Advisory DSA 1245-1                    security@...ian.org
http://www.debian.org/security/                         Moritz Muehlenhoff
January 7th, 2006                       http://www.debian.org/security/faq
- --------------------------------------------------------------------------

Package        : proftpd
Vulnerability  : programming error
Problem-Type   : remote
Debian-specific: no
CVE ID         : CVE-2005-4816
Debian Bug     : 404751

Martin Loewer discovered that the proftpd FTP daemon is vulnerable to
denial of service if the addon module for Radius authentication is enabled.

For the stable distribution (sarge) this problem has been fixed in
version 1.2.10-15sarge4.

For the upcoming stable distribution (etch) this problem has been
fixed in version 1.2.10+1.3.0rc5-1.

For the unstable distribution (sid) this problem has been fixed in
version 1.2.10+1.3.0rc5-1.

We recommend that you upgrade your proftpd package.


Upgrade Instructions
- --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.


Debian GNU/Linux 3.1 alias sarge
- --------------------------------

  Source archives:

    http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.10-15sarge4.dsc
      Size/MD5 checksum:      897 4bb3486da273b7f246396e54a672298d
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.10-15sarge4.diff.gz
      Size/MD5 checksum:   128904 accf444b76dd76b0bf076ada64195e81
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.10.orig.tar.gz
      Size/MD5 checksum:   920495 7d2bc5b4b1eef459a78e55c027a4f3c4

  Architecture independent components:

    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-doc_1.2.10-15sarge4_all.deb
      Size/MD5 checksum:   418032 6c5b89cdad81b31913de87105841dd1e

  Alpha architecture:

    http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.10-15sarge4_alpha.deb
      Size/MD5 checksum:   444480 fc8e4d8b8060b9fe582559c7b14af8e7
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-common_1.2.10-15sarge4_alpha.deb
      Size/MD5 checksum:   200968 9a870951184988f72d9012379a6eaf7a
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-ldap_1.2.10-15sarge4_alpha.deb
      Size/MD5 checksum:   457318 6aa9809aee60ee2d6151927f5916ce34
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-mysql_1.2.10-15sarge4_alpha.deb
      Size/MD5 checksum:   476904 b04b43ec13b396b40e305279e8a980e3
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-pgsql_1.2.10-15sarge4_alpha.deb
      Size/MD5 checksum:   476558 7ac9fb101fa756968c958f5bf47c7686

  AMD64 architecture:

    http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.10-15sarge4_amd64.deb
      Size/MD5 checksum:   389254 6bd512cb4bd2f8a264a4689a67a14bb9
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-common_1.2.10-15sarge4_amd64.deb
      Size/MD5 checksum:   194764 9f113824505cce070eeec9379c9dc885
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-ldap_1.2.10-15sarge4_amd64.deb
      Size/MD5 checksum:   400208 17f8fbcab75c416bdc0c3814637f48d4
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-mysql_1.2.10-15sarge4_amd64.deb
      Size/MD5 checksum:   415544 5315d8e9649fe27f5c1903d07c10b578
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-pgsql_1.2.10-15sarge4_amd64.deb
      Size/MD5 checksum:   415324 00b57a27a56deb76e0a1e39073b6cd25

  ARM architecture:

    http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.10-15sarge4_arm.deb
      Size/MD5 checksum:   374112 0965c04c1ce8378f51dc14fa3882d8d4
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-common_1.2.10-15sarge4_arm.deb
      Size/MD5 checksum:   188926 09d5f8d90fbd6226a589e8ebd1779347
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-ldap_1.2.10-15sarge4_arm.deb
      Size/MD5 checksum:   384246 3bf4887215a5b15f605c9208716bc039
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-mysql_1.2.10-15sarge4_arm.deb
      Size/MD5 checksum:   399130 6078dc20a109f70eea10bec067933227
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-pgsql_1.2.10-15sarge4_arm.deb
      Size/MD5 checksum:   398920 fb5286540adc5baa2a768c44ed81b350

  HP Precision architecture:

    http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.10-15sarge4_hppa.deb
      Size/MD5 checksum:   403802 eaa3c2b98127b55b4e454ad8e26c1385
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-common_1.2.10-15sarge4_hppa.deb
      Size/MD5 checksum:   194616 740063db391cc8e91a875043c0696b3d
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-ldap_1.2.10-15sarge4_hppa.deb
      Size/MD5 checksum:   414990 0e55529a7f7d852fb96f3262a702680f
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-mysql_1.2.10-15sarge4_hppa.deb
      Size/MD5 checksum:   431956 900ac31fc0ef48f7726495e870bbd195
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-pgsql_1.2.10-15sarge4_hppa.deb
      Size/MD5 checksum:   431700 e4ee9153c788d5b8d4f691b40a42c970

  Intel IA-32 architecture:

    http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.10-15sarge4_i386.deb
      Size/MD5 checksum:   371740 f4afca4abad80815388d82af744fe242
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-common_1.2.10-15sarge4_i386.deb
      Size/MD5 checksum:   189636 50dfe2e3126dcc8b7cc164f1d12969ef
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-ldap_1.2.10-15sarge4_i386.deb
      Size/MD5 checksum:   381896 82703bc0dbb797b5417c744a06a094ed
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-mysql_1.2.10-15sarge4_i386.deb
      Size/MD5 checksum:   397210 3f995554710621e5ec126e651787bad5
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-pgsql_1.2.10-15sarge4_i386.deb
      Size/MD5 checksum:   396998 77d34b542d227a65d428ffa1d8a33ca3

  Intel IA-64 architecture:

    http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.10-15sarge4_ia64.deb
      Size/MD5 checksum:   519866 743cd6f7c0360a68d191f83dedb226cc
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-common_1.2.10-15sarge4_ia64.deb
      Size/MD5 checksum:   207180 7bfaad1c8fa54f0b0d13ad75026a50ea
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-ldap_1.2.10-15sarge4_ia64.deb
      Size/MD5 checksum:   535514 624b5847eaaf7331ba4473a4a998ef9c
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-mysql_1.2.10-15sarge4_ia64.deb
      Size/MD5 checksum:   562540 23ba5248ccad6c75f3ee03d8bdc54ac4
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-pgsql_1.2.10-15sarge4_ia64.deb
      Size/MD5 checksum:   562366 93433536b9aef09a573a172c40a8d4f1

  Motorola 680x0 architecture:

    http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.10-15sarge4_m68k.deb
      Size/MD5 checksum:   332488 12e6fd84292ff109c9dec3322689f176
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-common_1.2.10-15sarge4_m68k.deb
      Size/MD5 checksum:   187288 a7ecdd1ee5dfaae278690cdd9092c38d
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-ldap_1.2.10-15sarge4_m68k.deb
      Size/MD5 checksum:   341016 e75f44fa2038c8f2dee1203349a62a09
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-mysql_1.2.10-15sarge4_m68k.deb
      Size/MD5 checksum:   353240 cc43c21a15a6e862df18e82b29e65f57
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-pgsql_1.2.10-15sarge4_m68k.deb
      Size/MD5 checksum:   352958 410894e0290f6eeac5decd8996186abd

  Big endian MIPS architecture:

    http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.10-15sarge4_mips.deb
      Size/MD5 checksum:   382560 a7194e12d0173f7a1130a842c76fe1d1
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-common_1.2.10-15sarge4_mips.deb
      Size/MD5 checksum:   201798 23e239465f075c6f8f1d724f687e626c
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-ldap_1.2.10-15sarge4_mips.deb
      Size/MD5 checksum:   392048 cf9750041e7128cadd73a99a8ca2569c
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-mysql_1.2.10-15sarge4_mips.deb
      Size/MD5 checksum:   406636 cb4a2ac79bf3b1c74d64db9e2c77d947
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-pgsql_1.2.10-15sarge4_mips.deb
      Size/MD5 checksum:   406416 832e2e03285701cc0c469185ca5a2fca

  Little endian MIPS architecture:

    http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.10-15sarge4_mipsel.deb
      Size/MD5 checksum:   384422 819609d01b95bc4a8e21180c55a24096
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-common_1.2.10-15sarge4_mipsel.deb
      Size/MD5 checksum:   202010 d8facfe7af0b99b1b05e6a5671abe489
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-ldap_1.2.10-15sarge4_mipsel.deb
      Size/MD5 checksum:   393532 5e2f37d07d9793ca99afcb9269e5ede6
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-mysql_1.2.10-15sarge4_mipsel.deb
      Size/MD5 checksum:   409628 a1e9c5453054a9220347f822ac83ece7
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-pgsql_1.2.10-15sarge4_mipsel.deb
      Size/MD5 checksum:   409390 347231a9363dcdd0d4c9ebe02b84458c

  PowerPC architecture:

    http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.10-15sarge4_powerpc.deb
      Size/MD5 checksum:   384604 645714c5221f671dfc5561f757834507
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-common_1.2.10-15sarge4_powerpc.deb
      Size/MD5 checksum:   195554 09ffa848bb4dc4fdba75eb0795d8098b
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-ldap_1.2.10-15sarge4_powerpc.deb
      Size/MD5 checksum:   395262 9114efd839caf4a4e64e127045bc972c
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-mysql_1.2.10-15sarge4_powerpc.deb
      Size/MD5 checksum:   412218 31a846c2ade77bbc1a6e5e43d3d4dc2d
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-pgsql_1.2.10-15sarge4_powerpc.deb
      Size/MD5 checksum:   411824 869b072b5d558a8f6f8f0494b38a6024

  IBM S/390 architecture:

    http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.10-15sarge4_s390.deb
      Size/MD5 checksum:   379786 03606ef08f344bb5462b81e525d61733
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-common_1.2.10-15sarge4_s390.deb
      Size/MD5 checksum:   193150 de4c7761d960492e6b7c526bebbfca68
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-ldap_1.2.10-15sarge4_s390.deb
      Size/MD5 checksum:   390248 0a786f8ad3d6fc4efff7b6c3825243ad
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-mysql_1.2.10-15sarge4_s390.deb
      Size/MD5 checksum:   404096 d507247c2896307a9ebc4e6a1330e2c6
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-pgsql_1.2.10-15sarge4_s390.deb
      Size/MD5 checksum:   403818 94aa1917df6b1f46ab079004efd75b44

  Sun Sparc architecture:

    http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.10-15sarge4_sparc.deb
      Size/MD5 checksum:   369958 3ab88aaa1466c9975dec9df3ee2db33e
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-common_1.2.10-15sarge4_sparc.deb
      Size/MD5 checksum:   189172 c4e651e5930c18b3002dbb20d7ad63ec
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-ldap_1.2.10-15sarge4_sparc.deb
      Size/MD5 checksum:   379626 323009aab72ccbc9646c35002dd8cd3b
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-mysql_1.2.10-15sarge4_sparc.deb
      Size/MD5 checksum:   395006 ec5b5f65e5db9856eebf430894d5b5fa
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-pgsql_1.2.10-15sarge4_sparc.deb
      Size/MD5 checksum:   394892 197da4298e2bae985628a133ce7c257e


  These files will probably be moved into the stable distribution on
  its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@...ts.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFFoOgRXm3vHE4uyloRAhL4AJoDEKH9ia8h38KkjUnloIvqeqYRGQCgppKn
bewtDubFiii9GaemUO/sB6I=
=JqcL
-----END PGP SIGNATURE-----