full-disclosure - [ MDVSA-2010:128 ] lftp

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-Id: <E1OWFo9-0004CX-Mm@titan.mandriva.com>
Date: Tue, 06 Jul 2010 23:36:01 +0200
From: security@...driva.com
To: full-disclosure@...ts.grok.org.uk
Subject: [ MDVSA-2010:128 ] lftp


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2010:128
 http://www.mandriva.com/security/
 _______________________________________________________________________

 Package : lftp
 Date    : July 6, 2010
 Affected: 2008.0, 2009.0, 2009.1, 2010.0, Enterprise Server 5.0
 _______________________________________________________________________

 Problem Description:

 A vulnerability has been found and corrected in lftp:
 
 The get1 command, as used by lftpget, in LFTP before 4.0.6 does not
 properly validate a server-provided filename before determining the
 destination filename of a download, which allows remote servers to
 create or overwrite arbitrary files via a Content-Disposition header
 that suggests a crafted filename, and possibly execute arbitrary
 code as a consequence of writing to a dotfile in a home directory
 (CVE-2010-2251).
 
 Packages for 2008.0 and 2009.0 are provided as of the Extended
 Maintenance Program. Please visit this link to learn more:
 http://store.mandriva.com/product_info.php?cPath=149&products_id=490
 
 Additionally on 2008.0 lftp has been upgraded to 3.7.4.
 
 The updated packages have been patched to correct this issue.
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2251
 _______________________________________________________________________

 Updated Packages:

 Mandriva Linux 2008.0:
 70002b25ea687e18daaf1d2d650d2311  2008.0/i586/lftp-3.7.4-0.1mdv2008.0.i586.rpm
 267d114587a3bb33a1924eafa2e53681  2008.0/i586/liblftp0-3.7.4-0.1mdv2008.0.i586.rpm
 670405b305aa03dcbe2c340a2813e2bd  2008.0/i586/liblftp-devel-3.7.4-0.1mdv2008.0.i586.rpm 
 4a37f82002ea3042d5f66562dad92837  2008.0/SRPMS/lftp-3.7.4-0.1mdv2008.0.src.rpm

 Mandriva Linux 2008.0/X86_64:
 e53191e7cc41c58982deddf3e7e628ce  2008.0/x86_64/lftp-3.7.4-0.1mdv2008.0.x86_64.rpm
 d518833d3ea17bde4a77b388c20ee262  2008.0/x86_64/lib64lftp0-3.7.4-0.1mdv2008.0.x86_64.rpm
 2c88562a368ccdf00841d4e044c8f012  2008.0/x86_64/lib64lftp-devel-3.7.4-0.1mdv2008.0.x86_64.rpm 
 4a37f82002ea3042d5f66562dad92837  2008.0/SRPMS/lftp-3.7.4-0.1mdv2008.0.src.rpm

 Mandriva Linux 2009.0:
 a04887286756ecf0218e67981098ee00  2009.0/i586/lftp-3.7.4-1.1mdv2009.0.i586.rpm
 2c9165b6386ed899758a2ea404a9385d  2009.0/i586/liblftp0-3.7.4-1.1mdv2009.0.i586.rpm
 8c86068b9e839b47a93c23541456b3cc  2009.0/i586/liblftp-devel-3.7.4-1.1mdv2009.0.i586.rpm 
 187fb4a21859de94bf111fdb21f22c4c  2009.0/SRPMS/lftp-3.7.4-1.1mdv2009.0.src.rpm

 Mandriva Linux 2009.0/X86_64:
 18e95b0f96e05c4f4d08ff7ff0ec29b0  2009.0/x86_64/lftp-3.7.4-1.1mdv2009.0.x86_64.rpm
 0b53aff2ff5bd9fb9cf36dfdedd3c582  2009.0/x86_64/lib64lftp0-3.7.4-1.1mdv2009.0.x86_64.rpm
 e6461691120dadda1f414a1611e4ece0  2009.0/x86_64/lib64lftp-devel-3.7.4-1.1mdv2009.0.x86_64.rpm 
 187fb4a21859de94bf111fdb21f22c4c  2009.0/SRPMS/lftp-3.7.4-1.1mdv2009.0.src.rpm

 Mandriva Linux 2009.1:
 d9069ed3bb5e11948564e280565f0768  2009.1/i586/lftp-3.7.9-1.1mdv2009.1.i586.rpm
 80a0214dcea80af012c07eea76c4e5c7  2009.1/i586/liblftp0-3.7.9-1.1mdv2009.1.i586.rpm
 a5c2a6e01c53d6dd1d990bcdbeb1c68c  2009.1/i586/liblftp-devel-3.7.9-1.1mdv2009.1.i586.rpm 
 2e8cab06f3d9a82ea69ad764e189bb4a  2009.1/SRPMS/lftp-3.7.9-1.1mdv2009.1.src.rpm

 Mandriva Linux 2009.1/X86_64:
 97657f39c592d50f47c8f65df94a2e19  2009.1/x86_64/lftp-3.7.9-1.1mdv2009.1.x86_64.rpm
 e029a26bf63f859393b05ad8be3121c4  2009.1/x86_64/lib64lftp0-3.7.9-1.1mdv2009.1.x86_64.rpm
 374fe6c5118959366aa568861e868b49  2009.1/x86_64/lib64lftp-devel-3.7.9-1.1mdv2009.1.x86_64.rpm 
 2e8cab06f3d9a82ea69ad764e189bb4a  2009.1/SRPMS/lftp-3.7.9-1.1mdv2009.1.src.rpm

 Mandriva Linux 2010.0:
 7e40d6fed798df5e6e2ad91f0518f1fe  2010.0/i586/lftp-3.7.15-1.1mdv2010.0.i586.rpm
 a0f2d233784d358a9b908650e69c2ccc  2010.0/i586/liblftp0-3.7.15-1.1mdv2010.0.i586.rpm
 217d90aadfc3344ec3cdc0dedb97e819  2010.0/i586/liblftp-devel-3.7.15-1.1mdv2010.0.i586.rpm 
 862ebfc437fcbc900662366f93df5d70  2010.0/SRPMS/lftp-3.7.15-1.1mdv2010.0.src.rpm

 Mandriva Linux 2010.0/X86_64:
 54b1fec82936e06338906db09b49a8a6  2010.0/x86_64/lftp-3.7.15-1.1mdv2010.0.x86_64.rpm
 17598246912347e614013f002338365d  2010.0/x86_64/lib64lftp0-3.7.15-1.1mdv2010.0.x86_64.rpm
 aa6338f3dd92dbc7adf3ae978db61a5b  2010.0/x86_64/lib64lftp-devel-3.7.15-1.1mdv2010.0.x86_64.rpm 
 862ebfc437fcbc900662366f93df5d70  2010.0/SRPMS/lftp-3.7.15-1.1mdv2010.0.src.rpm

 Mandriva Enterprise Server 5:
 e0fe03efa978c234e8365fe9ab08ad9c  mes5/i586/lftp-3.7.4-1.1mdvmes5.1.i586.rpm
 1c57f9608cbd607bda8bf55bc76600d9  mes5/i586/liblftp0-3.7.4-1.1mdvmes5.1.i586.rpm
 dff1c808bb1cfa0b0e067e6c41b3db03  mes5/i586/liblftp-devel-3.7.4-1.1mdvmes5.1.i586.rpm 
 5d46343519e5e1a495ed1d7980527dd6  mes5/SRPMS/lftp-3.7.4-1.1mdvmes5.1.src.rpm

 Mandriva Enterprise Server 5/X86_64:
 aa0674de92d88ea5520e6c86e77fa3e6  mes5/x86_64/lftp-3.7.4-1.1mdvmes5.1.x86_64.rpm
 c415d4ff0363c8c264de64f019e988b0  mes5/x86_64/lib64lftp0-3.7.4-1.1mdvmes5.1.x86_64.rpm
 26f7432fb7542a7f0eaecea1b947e47d  mes5/x86_64/lib64lftp-devel-3.7.4-1.1mdvmes5.1.x86_64.rpm 
 5d46343519e5e1a495ed1d7980527dd6  mes5/SRPMS/lftp-3.7.4-1.1mdvmes5.1.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFMM3CamqjQ0CJFipgRAhmWAJ4oI1aCNDTCOkdPPcQ/ZyV0lNC5VQCfQW/x
/dxwGaJe13c82YdTpx3eRJI=
=KOVM
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/