Home
Reading
Searching
Subscribe
Sponsors
Statistics
Posting
Contact
Spam
Lists
Links
About
Hosting
Filtering
Features Download
Marketing
Archives
FAQ
Blog
 
Gmane
From: <updates <at> fedoraproject.org>
Subject: [SECURITY] Fedora 16 Update: proftpd-1.3.4b-5.fc16
Newsgroups: gmane.linux.redhat.fedora.package.announce
Date: Wednesday 30th January 2013 00:31:45 UTC (over 4 years ago)
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2013-0468
2013-01-09 08:16:42
--------------------------------------------------------------------------------

Name        : proftpd
Product     : Fedora 16
Version     : 1.3.4b
Release     : 5.fc16
URL         : http://www.proftpd.org/
Summary     : Flexible, stable and highly-configurable FTP server
Description :
ProFTPD is an enhanced FTP server with a focus toward simplicity, security,
and ease of configuration. It features a very Apache-like configuration
syntax, and a highly customizable server infrastructure, including support
for
multiple 'virtual' FTP servers, anonymous FTP, and permission-based
directory
visibility.

This package defaults to the standalone behavior of ProFTPD, but all the
needed scripts to have it run by xinetd instead are included.

--------------------------------------------------------------------------------
Update Information:

Jann Horn reported that there is a possible race condition in the handling
of the MKD/XMKD FTP commands, when the UserOwner directive is involved, and
the attacker is on the same physical machine as a running proftpd. This
race applies to mod_sftp and the handling of the MKDIR SFTP request as
well.

Note that using the DefaultRoot directive to restrict sessions mitigates
this attack, since the symlinks created by the local attacker will point
outside of the chroot(2) area within the FTP session, and thus the
ownership change will fail. The default configuration in Fedora applies the
DefaultRoot directive to all users except "adm".

The upstream reference for this issue is:
http://bugs.proftpd.org/show_bug.cgi?id=3841

This update includes upstream's backport to proftpd 1.3.4 of the fix for
this issue.
--------------------------------------------------------------------------------
ChangeLog:

* Wed Jan 16 2013 Paul Howarth  1.3.4b-5
- Update patch for CVE-2012-6095 to cover vroot cases
* Mon Jan  7 2013 Paul Howarth  1.3.4b-4
- Fix possible symlink race when applying UserOwner to newly created
directory
  (CVE-2012-6095, #892715, http://bugs.proftpd.org/show_bug.cgi?id=3841)
* Sat Sep 22 2012 Remi Collet  1.3.4b-3
- Rebuild against libmemcached.so.11 without SASL
* Thu Aug 30 2012 Paul Howarth  1.3.4b-2
- Add support for systemd presets in Fedora 18+ (#850281)
* Wed Aug  1 2012 Paul Howarth  1.3.4b-1
- Update to 1.3.4b
  - Fixed mod_ldap segfault on login when LDAPUsers with no filters used
  - Fixed sporadic SFTP upload issues for large files
  - Fixed SSH2 handling for some clients (e.g. OpenVMS)
  - New FactsOptions directive; see doc/modules/mod_facts.html#FactsOptions
  - Fixed build errors on Tru64, AIX, Cygwin
  - Lots of bugs fixed - see NEWS for details
- No bzipped tarball release this time, so revert to gzipped one
- Drop patches for fixes included in upstream release
* Sat Jul 21 2012 Fedora Release Engineering
 1.3.4a-11
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
* Tue Jul  3 2012 Paul Howarth  1.3.4a-10
- Move tmpfiles.d file from %{_sysconfdir} to %{_prefix}/lib
* Sat Apr 21 2012 Paul Howarth  1.3.4a-9
- Rebuild for new libmemcached in Rawhide
* Fri Apr 13 2012 Paul Howarth  1.3.4a-8
- Do hardened (PIE) builds where possible
- Drop %defattr, redundant since rpm 4.4
- Always look for TLS certs in /etc/pki/tls/certs
* Mon Mar 12 2012 Paul Howarth  1.3.4a-7
- Tweak logrotate script for systemd compatibility (#802178)
- Fix leaked file descriptors for log files (as per bug 3751)
* Sat Mar  3 2012 Paul Howarth  1.3.4a-6
- Rebuild for new libmemcached in Rawhide
* Tue Feb 28 2012 Paul Howarth  1.3.4a-5
- Document SELinux configuration for ProFTPD in proftpd.conf (#785443)
- Add support for basic and administrative controls actions using ftpdctl
by
  default (#786623)
- Add trace logging directives in proftpd.conf but disable them by default
as
  they impair performance
- Fix ftpwho/ftptop not showing command arguments (bug 3714)
- Fix MLSD/MLST fail with "DirFakeUser off" or "DirFakeGroup off" (bug
3715)
- Fix proftpd fails to run with "Abort trap" error message (bug 3717)
- Fix LIST -R can loop endlessly if bad directory symlink exists (bug 3719)
- Fix overly restrictive module logfile permissions (bug 3720)
- Fix mod_memcache segfault on server restart (bug 3723)
- Fix unloading mod_quotatab causes segfault (#757311, bug 3724)
- Fix mod_exec does not always capture stdout/stderr output from executed
  command (bug 3726)
- Fix mod_wrap2 causes unexpected LogFormat %u expansion for SFTP
connections
  (bug 3727)
- Fix mod_ldap segfault when LDAPUsers is used with no optional filters
  (bug 3729)
- Fix DirFakeUser/DirFakeGroup off with name causes SIGSEGV for MLSD/MLST
  commands (bug 3734)
- Fix improper handling of self-signed