[Slackit.org] [slackware-security] ProFTPD Security Advisory (SSA:2003-259-02)

[Andrea Guarnaccia]

> [slackware-security]  ProFTPD Security Advisory (SSA:2003-259-02)
>
> Upgraded ProFTPD packages are available for Slackware 8.1, 9.0 and
> - -current.  These fix a security issue where an attacker could gain
> a root shell by downloading a specially crafted file.
>
>
> Here are the details from the Slackware 9.0 ChangeLog:
> +--------------------------+
> Tue Sep 23 14:43:10 PDT 2003
> n/proftpd-1.2.8p-i486-1.tgz:  Upgraded to proftpd-1.2.8p (patched).
>   This fixes a security problem in ProFTPD.  From http://www.proftpd.org:
>
>     X-Force Research at ISS has discovered a remote exploit in ProFTPD's
>     handling of ASCII translations that an attacker, by downloading a
>     carefully crafted file, can exploit and gain a root shell.  The source
>     distributions on ftp.proftpd.org have all been replaced with patched
>     versions. All ProFTPD users are strongly urged to upgrade to one of
>     the patched versions as soon as possible.
>
>   Note that the upgraded package does not change the displayed version
>   number to 1.2.8p (it remains 1.2.8), but we've verified the source code
>   to make sure that this is in fact the patched version.  We recommend all
>   sites running ProFTPD upgrade to the new package right away.
>   (* Security fix *)
> +--------------------------+
>
>
> WHERE TO FIND THE NEW PACKAGES:
> +-----------------------------+
>
> Updated package for Slackware 8.1:
> ftp://ftp.slackware.com/pub/slackware/slackware-8.1/patches/packages/proftpd-1.2.8p-i386-1.tgz
>
> Updated package for Slackware 9.0:
> ftp://ftp.slackware.com/pub/slackware/slackware-9.0/patches/packages/proftpd-1.2.8p-i386-1.tgz
>
> Updated package for Slackware -current:
> ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/proftpd-1.2.8p-i486-1.tgz
>
>
> MD5 SIGNATURES:
> +-------------+
>
> Slackware 8.1 package:
> 8b31d10bab91a0d4a22c7eac69a90087  proftpd-1.2.8p-i386-1.tgz
>
> Slackware 9.0 package:
> 391d5e24bade1ff98281465d230ddad5  proftpd-1.2.8p-i386-1.tgz
>
> Slackware -current package:
> 2636a2306a6acb0d8726995de9013678  proftpd-1.2.8p-i486-1.tgz
>
>
> INSTALLATION INSTRUCTIONS:
> +------------------------+
>
> Upgrade using upgradepkg (as root):
> # upgradepkg proftpd-1.2.8p-i386-1.tgz
>
>
>
> +-----+
>
> Slackware Linux Security Team
> http://slackware.com/gpg-key
> address@hidden