From security@linux-mandrake.com Fri Apr 30 16:42:25 2004 From: Mandrake Linux Security Team To: full-disclosure@lists.netsys.com Date: 30 Apr 2004 20:09:15 -0000 Subject: [Full-Disclosure] MDKSA-2004:041 - Updated ProFTPD packages fix vulnerability -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandrakelinux Security Update Advisory _______________________________________________________________________ Package name: proftpd Advisory ID: MDKSA-2004:041 Date: April 30th, 2004 Affected versions: 10.0 ______________________________________________________________________ Problem Description: A portability workaround that was applied in version 1.2.9 of the ProFTPD FTP server caused CIDR based ACL entries in "Allow" and "Deny" directives to act like an "AllowAll" directive. This granted FTP clients access to files and directories that the server configuration may have been explicitly denying. This problem only exists in version 1.2.9 and has been fixed upstream. A patch has been applied to correct the problem. _______________________________________________________________________ References: http://bugs.proftpd.org/show_bug.cgi?id=2267 ______________________________________________________________________ Updated Packages: Mandrakelinux 10.0: 101925465015f7306e3fcf42db6c6c9b 10.0/RPMS/proftpd-1.2.9-3.1.100mdk.i586.rpm f528f42bb43e0f8cdcb8d6bb43b8c072 10.0/RPMS/proftpd-anonymous-1.2.9-3.1.100mdk.i586.rpm 55c01dbc795e68adde5714b6ebef1c38 10.0/SRPMS/proftpd-1.2.9-3.1.100mdk.src.rpm _______________________________________________________________________ To upgrade automatically use MandrakeUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. A list of FTP mirrors can be obtained from: http://www.mandrakesecure.net/en/ftp.php All packages are signed by Mandrakesoft for security. You can obtain the GPG public key of the Mandrakelinux Security Team by executing: gpg --recv-keys --keyserver www.mandrakesecure.net 0x22458A98 Please be aware that sometimes it takes the mirrors a few hours to update. You can view other update advisories for Mandrakelinux at: http://www.mandrakesecure.net/en/advisories/ Mandrakesoft has several security-related mailing list services that anyone can subscribe to. Information on these lists can be obtained by visiting: http://www.mandrakesecure.net/en/mlist.php If you want to report vulnerabilities, please contact security_linux-mandrake.com Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Linux Mandrake Security Team -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.7 (GNU/Linux) iD8DBQFAkrJrmqjQ0CJFipgRAiBRAJoCZayeuU3Enp2NgGMDcU7SynXsmgCfXZkA Zilzyh4RLbiqT9Mko++JLvw= =Y10i -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html