lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <20070107123349.GA4900@galadriel.inutil.org> Date: Sun, 7 Jan 2007 13:33:49 +0100 From: Moritz Muehlenhoff <jmm@...ian.org> To: debian-security-announce@...ts.debian.org Subject: [SECURITY] [DSA 1245-1] New proftpd packages fix denial of service -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA 1245-1 security@...ian.org http://www.debian.org/security/ Moritz Muehlenhoff January 7th, 2006 http://www.debian.org/security/faq - -------------------------------------------------------------------------- Package : proftpd Vulnerability : programming error Problem-Type : remote Debian-specific: no CVE ID : CVE-2005-4816 Debian Bug : 404751 Martin Loewer discovered that the proftpd FTP daemon is vulnerable to denial of service if the addon module for Radius authentication is enabled. For the stable distribution (sarge) this problem has been fixed in version 1.2.10-15sarge4. For the upcoming stable distribution (etch) this problem has been fixed in version 1.2.10+1.3.0rc5-1. For the unstable distribution (sid) this problem has been fixed in version 1.2.10+1.3.0rc5-1. We recommend that you upgrade your proftpd package. Upgrade Instructions - -------------------- wget url will fetch the file for you dpkg -i file.deb will install the referenced file. If you are using the apt-get package manager, use the line for sources.list as given below: apt-get update will update the internal database apt-get upgrade will install corrected packages You may use an automated update by adding the resources from the footer to the proper configuration. Debian GNU/Linux 3.1 alias sarge - -------------------------------- Source archives: http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.10-15sarge4.dsc Size/MD5 checksum: 897 4bb3486da273b7f246396e54a672298d http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.10-15sarge4.diff.gz Size/MD5 checksum: 128904 accf444b76dd76b0bf076ada64195e81 http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.10.orig.tar.gz Size/MD5 checksum: 920495 7d2bc5b4b1eef459a78e55c027a4f3c4 Architecture independent components: http://security.debian.org/pool/updates/main/p/proftpd/proftpd-doc_1.2.10-15sarge4_all.deb Size/MD5 checksum: 418032 6c5b89cdad81b31913de87105841dd1e Alpha architecture: http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.10-15sarge4_alpha.deb Size/MD5 checksum: 444480 fc8e4d8b8060b9fe582559c7b14af8e7 http://security.debian.org/pool/updates/main/p/proftpd/proftpd-common_1.2.10-15sarge4_alpha.deb Size/MD5 checksum: 200968 9a870951184988f72d9012379a6eaf7a http://security.debian.org/pool/updates/main/p/proftpd/proftpd-ldap_1.2.10-15sarge4_alpha.deb Size/MD5 checksum: 457318 6aa9809aee60ee2d6151927f5916ce34 http://security.debian.org/pool/updates/main/p/proftpd/proftpd-mysql_1.2.10-15sarge4_alpha.deb Size/MD5 checksum: 476904 b04b43ec13b396b40e305279e8a980e3 http://security.debian.org/pool/updates/main/p/proftpd/proftpd-pgsql_1.2.10-15sarge4_alpha.deb Size/MD5 checksum: 476558 7ac9fb101fa756968c958f5bf47c7686 AMD64 architecture: http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.10-15sarge4_amd64.deb Size/MD5 checksum: 389254 6bd512cb4bd2f8a264a4689a67a14bb9 http://security.debian.org/pool/updates/main/p/proftpd/proftpd-common_1.2.10-15sarge4_amd64.deb Size/MD5 checksum: 194764 9f113824505cce070eeec9379c9dc885 http://security.debian.org/pool/updates/main/p/proftpd/proftpd-ldap_1.2.10-15sarge4_amd64.deb Size/MD5 checksum: 400208 17f8fbcab75c416bdc0c3814637f48d4 http://security.debian.org/pool/updates/main/p/proftpd/proftpd-mysql_1.2.10-15sarge4_amd64.deb Size/MD5 checksum: 415544 5315d8e9649fe27f5c1903d07c10b578 http://security.debian.org/pool/updates/main/p/proftpd/proftpd-pgsql_1.2.10-15sarge4_amd64.deb Size/MD5 checksum: 415324 00b57a27a56deb76e0a1e39073b6cd25 ARM architecture: http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.10-15sarge4_arm.deb Size/MD5 checksum: 374112 0965c04c1ce8378f51dc14fa3882d8d4 http://security.debian.org/pool/updates/main/p/proftpd/proftpd-common_1.2.10-15sarge4_arm.deb Size/MD5 checksum: 188926 09d5f8d90fbd6226a589e8ebd1779347 http://security.debian.org/pool/updates/main/p/proftpd/proftpd-ldap_1.2.10-15sarge4_arm.deb Size/MD5 checksum: 384246 3bf4887215a5b15f605c9208716bc039 http://security.debian.org/pool/updates/main/p/proftpd/proftpd-mysql_1.2.10-15sarge4_arm.deb Size/MD5 checksum: 399130 6078dc20a109f70eea10bec067933227 http://security.debian.org/pool/updates/main/p/proftpd/proftpd-pgsql_1.2.10-15sarge4_arm.deb Size/MD5 checksum: 398920 fb5286540adc5baa2a768c44ed81b350 HP Precision architecture: http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.10-15sarge4_hppa.deb Size/MD5 checksum: 403802 eaa3c2b98127b55b4e454ad8e26c1385 http://security.debian.org/pool/updates/main/p/proftpd/proftpd-common_1.2.10-15sarge4_hppa.deb Size/MD5 checksum: 194616 740063db391cc8e91a875043c0696b3d http://security.debian.org/pool/updates/main/p/proftpd/proftpd-ldap_1.2.10-15sarge4_hppa.deb Size/MD5 checksum: 414990 0e55529a7f7d852fb96f3262a702680f http://security.debian.org/pool/updates/main/p/proftpd/proftpd-mysql_1.2.10-15sarge4_hppa.deb Size/MD5 checksum: 431956 900ac31fc0ef48f7726495e870bbd195 http://security.debian.org/pool/updates/main/p/proftpd/proftpd-pgsql_1.2.10-15sarge4_hppa.deb Size/MD5 checksum: 431700 e4ee9153c788d5b8d4f691b40a42c970 Intel IA-32 architecture: http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.10-15sarge4_i386.deb Size/MD5 checksum: 371740 f4afca4abad80815388d82af744fe242 http://security.debian.org/pool/updates/main/p/proftpd/proftpd-common_1.2.10-15sarge4_i386.deb Size/MD5 checksum: 189636 50dfe2e3126dcc8b7cc164f1d12969ef http://security.debian.org/pool/updates/main/p/proftpd/proftpd-ldap_1.2.10-15sarge4_i386.deb Size/MD5 checksum: 381896 82703bc0dbb797b5417c744a06a094ed http://security.debian.org/pool/updates/main/p/proftpd/proftpd-mysql_1.2.10-15sarge4_i386.deb Size/MD5 checksum: 397210 3f995554710621e5ec126e651787bad5 http://security.debian.org/pool/updates/main/p/proftpd/proftpd-pgsql_1.2.10-15sarge4_i386.deb Size/MD5 checksum: 396998 77d34b542d227a65d428ffa1d8a33ca3 Intel IA-64 architecture: http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.10-15sarge4_ia64.deb Size/MD5 checksum: 519866 743cd6f7c0360a68d191f83dedb226cc http://security.debian.org/pool/updates/main/p/proftpd/proftpd-common_1.2.10-15sarge4_ia64.deb Size/MD5 checksum: 207180 7bfaad1c8fa54f0b0d13ad75026a50ea http://security.debian.org/pool/updates/main/p/proftpd/proftpd-ldap_1.2.10-15sarge4_ia64.deb Size/MD5 checksum: 535514 624b5847eaaf7331ba4473a4a998ef9c http://security.debian.org/pool/updates/main/p/proftpd/proftpd-mysql_1.2.10-15sarge4_ia64.deb Size/MD5 checksum: 562540 23ba5248ccad6c75f3ee03d8bdc54ac4 http://security.debian.org/pool/updates/main/p/proftpd/proftpd-pgsql_1.2.10-15sarge4_ia64.deb Size/MD5 checksum: 562366 93433536b9aef09a573a172c40a8d4f1 Motorola 680x0 architecture: http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.10-15sarge4_m68k.deb Size/MD5 checksum: 332488 12e6fd84292ff109c9dec3322689f176 http://security.debian.org/pool/updates/main/p/proftpd/proftpd-common_1.2.10-15sarge4_m68k.deb Size/MD5 checksum: 187288 a7ecdd1ee5dfaae278690cdd9092c38d http://security.debian.org/pool/updates/main/p/proftpd/proftpd-ldap_1.2.10-15sarge4_m68k.deb Size/MD5 checksum: 341016 e75f44fa2038c8f2dee1203349a62a09 http://security.debian.org/pool/updates/main/p/proftpd/proftpd-mysql_1.2.10-15sarge4_m68k.deb Size/MD5 checksum: 353240 cc43c21a15a6e862df18e82b29e65f57 http://security.debian.org/pool/updates/main/p/proftpd/proftpd-pgsql_1.2.10-15sarge4_m68k.deb Size/MD5 checksum: 352958 410894e0290f6eeac5decd8996186abd Big endian MIPS architecture: http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.10-15sarge4_mips.deb Size/MD5 checksum: 382560 a7194e12d0173f7a1130a842c76fe1d1 http://security.debian.org/pool/updates/main/p/proftpd/proftpd-common_1.2.10-15sarge4_mips.deb Size/MD5 checksum: 201798 23e239465f075c6f8f1d724f687e626c http://security.debian.org/pool/updates/main/p/proftpd/proftpd-ldap_1.2.10-15sarge4_mips.deb Size/MD5 checksum: 392048 cf9750041e7128cadd73a99a8ca2569c http://security.debian.org/pool/updates/main/p/proftpd/proftpd-mysql_1.2.10-15sarge4_mips.deb Size/MD5 checksum: 406636 cb4a2ac79bf3b1c74d64db9e2c77d947 http://security.debian.org/pool/updates/main/p/proftpd/proftpd-pgsql_1.2.10-15sarge4_mips.deb Size/MD5 checksum: 406416 832e2e03285701cc0c469185ca5a2fca Little endian MIPS architecture: http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.10-15sarge4_mipsel.deb Size/MD5 checksum: 384422 819609d01b95bc4a8e21180c55a24096 http://security.debian.org/pool/updates/main/p/proftpd/proftpd-common_1.2.10-15sarge4_mipsel.deb Size/MD5 checksum: 202010 d8facfe7af0b99b1b05e6a5671abe489 http://security.debian.org/pool/updates/main/p/proftpd/proftpd-ldap_1.2.10-15sarge4_mipsel.deb Size/MD5 checksum: 393532 5e2f37d07d9793ca99afcb9269e5ede6 http://security.debian.org/pool/updates/main/p/proftpd/proftpd-mysql_1.2.10-15sarge4_mipsel.deb Size/MD5 checksum: 409628 a1e9c5453054a9220347f822ac83ece7 http://security.debian.org/pool/updates/main/p/proftpd/proftpd-pgsql_1.2.10-15sarge4_mipsel.deb Size/MD5 checksum: 409390 347231a9363dcdd0d4c9ebe02b84458c PowerPC architecture: http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.10-15sarge4_powerpc.deb Size/MD5 checksum: 384604 645714c5221f671dfc5561f757834507 http://security.debian.org/pool/updates/main/p/proftpd/proftpd-common_1.2.10-15sarge4_powerpc.deb Size/MD5 checksum: 195554 09ffa848bb4dc4fdba75eb0795d8098b http://security.debian.org/pool/updates/main/p/proftpd/proftpd-ldap_1.2.10-15sarge4_powerpc.deb Size/MD5 checksum: 395262 9114efd839caf4a4e64e127045bc972c http://security.debian.org/pool/updates/main/p/proftpd/proftpd-mysql_1.2.10-15sarge4_powerpc.deb Size/MD5 checksum: 412218 31a846c2ade77bbc1a6e5e43d3d4dc2d http://security.debian.org/pool/updates/main/p/proftpd/proftpd-pgsql_1.2.10-15sarge4_powerpc.deb Size/MD5 checksum: 411824 869b072b5d558a8f6f8f0494b38a6024 IBM S/390 architecture: http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.10-15sarge4_s390.deb Size/MD5 checksum: 379786 03606ef08f344bb5462b81e525d61733 http://security.debian.org/pool/updates/main/p/proftpd/proftpd-common_1.2.10-15sarge4_s390.deb Size/MD5 checksum: 193150 de4c7761d960492e6b7c526bebbfca68 http://security.debian.org/pool/updates/main/p/proftpd/proftpd-ldap_1.2.10-15sarge4_s390.deb Size/MD5 checksum: 390248 0a786f8ad3d6fc4efff7b6c3825243ad http://security.debian.org/pool/updates/main/p/proftpd/proftpd-mysql_1.2.10-15sarge4_s390.deb Size/MD5 checksum: 404096 d507247c2896307a9ebc4e6a1330e2c6 http://security.debian.org/pool/updates/main/p/proftpd/proftpd-pgsql_1.2.10-15sarge4_s390.deb Size/MD5 checksum: 403818 94aa1917df6b1f46ab079004efd75b44 Sun Sparc architecture: http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.10-15sarge4_sparc.deb Size/MD5 checksum: 369958 3ab88aaa1466c9975dec9df3ee2db33e http://security.debian.org/pool/updates/main/p/proftpd/proftpd-common_1.2.10-15sarge4_sparc.deb Size/MD5 checksum: 189172 c4e651e5930c18b3002dbb20d7ad63ec http://security.debian.org/pool/updates/main/p/proftpd/proftpd-ldap_1.2.10-15sarge4_sparc.deb Size/MD5 checksum: 379626 323009aab72ccbc9646c35002dd8cd3b http://security.debian.org/pool/updates/main/p/proftpd/proftpd-mysql_1.2.10-15sarge4_sparc.deb Size/MD5 checksum: 395006 ec5b5f65e5db9856eebf430894d5b5fa http://security.debian.org/pool/updates/main/p/proftpd/proftpd-pgsql_1.2.10-15sarge4_sparc.deb Size/MD5 checksum: 394892 197da4298e2bae985628a133ce7c257e These files will probably be moved into the stable distribution on its next update. - --------------------------------------------------------------------------------- For apt-get: deb http://security.debian.org/ stable/updates main For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main Mailing list: debian-security-announce@...ts.debian.org Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (GNU/Linux) iD8DBQFFoOgRXm3vHE4uyloRAhL4AJoDEKH9ia8h38KkjUnloIvqeqYRGQCgppKn bewtDubFiii9GaemUO/sB6I= =JqcL -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/