Message-ID: <200309301818.39963.security-announce@turbolinux.co.jp>
From: security-announce at turbolinux.co.jp (Turbolinux)
Subject: [TURBOLINUX SECURITY INFO] 30/Sep/2003

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

This is an announcement only email list for the x86 architecture.
============================================================
Turbolinux Security Announcement 30/Sep/2003
============================================================

The following page contains the security information of Turbolinux Inc.

 - Turbolinux Security Center
   http://www.turbolinux.com/security/

 (1) proftpd -> ASCII File Remote Compromise Vulnerability


===========================================================
* proftpd -> ASCII File Remote Compromise Vulnerability
===========================================================

More information :
    ProFTPD grew out of the desire to have a secure and configurable FTP server,
    and out of a significant admiration of the Apache web server.
    There are currently a very limited number of FTP servers running on Unix (or Unix-like) hosts. 
    A vulnerability exists in the ProFTPD server that can be triggered by
    remote attackers when transferring files from the FTP server in ASCII mode.
    The attacker must have the ability to upload a file to the server,
    and then attempt to download the same file to trigger the vulnerability.

 Impact :
    This vulnerability may allow a remote attacker to execute arbitrary code.

 Affected Products :
    - Turbolinux 8 Server
    - Turbolinux 8 Workstation
    - Turbolinux 7 Server
    - Turbolinux 7 Workstation
    - Turbolinux Server 6.5


 Solution :
    Please use turbopkg(zabom) tool to apply the update.
 ---------------------------------------------
 # turbopkg
 or
 # zabom update proftpd
 ---------------------------------------------


 <Turbolinux 8 Server>

   Source Packages
   Size : MD5

   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/8/updates/SRPMS/proftpd-1.2.8-3.src.rpm
       799310 0b085b2534d2ef187190e28c0d3c82b0

   Binary Packages
   Size : MD5

   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/8/updates/RPMS/proftpd-1.2.8-3.i586.rpm
       494255 41ef87d4add81c3e9b6b5798f0f5e53b

 <Turbolinux 8 Workstation>

   Source Packages
   Size : MD5

   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Workstation/8/updates/SRPMS/proftpd-1.2.8-3.src.rpm
       799310 c7c4ba58a0f45c9aa9ec37e71415683d

   Binary Packages
   Size : MD5

   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Workstation/8/updates/RPMS/proftpd-1.2.8-3.i586.rpm
       494317 aff059772cb4e8a83626165af3c2c918

 <Turbolinux 7 Server>

   Source Packages
   Size : MD5

   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/7/updates/SRPMS/proftpd-1.2.8-3.src.rpm
       799310 725dc29f67cab5fa77a236154033b3c7

   Binary Packages
   Size : MD5

   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/7/updates/RPMS/proftpd-1.2.8-3.i586.rpm
       486609 fc1a2b813257322095e6303dc4c27799

 <Turbolinux 7 Workstation>

   Source Packages
   Size : MD5

   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Workstation/7/updates/SRPMS/proftpd-1.2.8-3.src.rpm
       799310 a3d08e2e400f57b66fd7c2022abd1d09

   Binary Packages
   Size : MD5

   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Workstation/7/updates/RPMS/proftpd-1.2.8-3.i586.rpm
       486725 67f5f2f278a25548fd5424d5c481e151

 <Turbolinux Server 6.5>

   Source Packages
   Size : MD5

   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/6.5/updates/SRPMS/proftpd-1.2.8-3.src.rpm
       799310 28b82c94e03161660db0a061e272b3cd

   Binary Packages
   Size : MD5

   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/6.5/updates/RPMS/proftpd-1.2.8-3.i386.rpm
       597007 830ce6d43eefabe6f52333fd34d52a98


 Notice :
    After performing the update, it is necessary to restart the proftpd daemon.
    To do this, run the following command as user root.
 ---------------------------------------------
 # /etc/init.d/proftpd restart
 or
 # /etc/rc.d/init.d/proftpd restart
 ---------------------------------------------


 References :

 ProFTPD org
   [News Flashes]
   http://www.proftpd.org/index.html

 CVE
   [CAN-2003-0831]
   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0831


 --------------------------------------------------------------------------
 Revision History
    30 Sep 2003 Initial release
 --------------------------------------------------------------------------


 * You may need to update the turbopkg tool before applying the update.
Please refer to the following URL for detailed information.

  http://www.turbolinux.com/download/zabom.html
  http://www.turbolinux.com/download/zabomupdate.html

Package Update Path
http://www.turbolinux.com/update

============================================================
 * To obtain the public key

Here is the public key

 http://www.turbolinux.com/security/

 * To unsubscribe from the list

If you ever want to remove yourself from this mailing list,
  you can send a message to <server-users-e-ctl@...bolinux.co.jp> with
the word `unsubscribe' in the body (don't include the quotes).

unsubscribe

 * To change your email address

If you ever want to chage email address in this mailing list,
  you can send a message to <server-users-e-ctl@...bolinux.co.jp> with
the following command in the message body:

  chaddr 'old address' 'new address'

If you have any questions or problems, please contact
<supp_info@...bolinux.co.jp>

Thank you!

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (GNU/Linux)

iD8DBQE/eUpeK0LzjOqIJMwRAgHMAKC1xePRCUT7zjP0zzrz+kh2QUfU1wCgkkFn
6W/tCuVbAJHn3Dm34MAe8UA=
=CZXF
-----END PGP SIGNATURE-----

Powered by blists - more mailing lists