From tsl@trustix.org Fri Aug 5 16:38:43 2005 From: Trustix Security Advisor To: bugtraq@securityfocus.com Date: Fri, 5 Aug 2005 18:49:46 +0200 Subject: TSLSA-2005-0040 - multi -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Trustix Secure Linux Security Advisory #2005-0040 Package names: bzip2, perl-compress-zlib, proftpd Summary: Multiple vulnerabilities Date: 2005-08-05 Affected versions: Trustix Secure Linux 2.2 Trustix Secure Linux 3.0 Trustix Operating System - Enterprise Server 2 - -------------------------------------------------------------------------- Package description: bzip2 Bzip2 is a freely available, patent-free, high quality data compressor. Bzip2 compresses files to within 10 to 15 percent of the capabilities of the best techniques available. However, bzip2 has the added benefit of being approximately two times faster at compression and six times faster at decompression than those techniques. Bzip2 is not the fastest compression utility, but it does strike a balance between speed and compression capability. perl-compress-zlib Compress-Zlib module from CPAN for perl proftpd ProFTPd is an enhanced FTP server with a focus toward simplicity, security, and ease of configuration. It features a very Apache-like configuration syntax, and a highly customizable server infrastructure, including support for multiple 'virtual' FTP servers, anonymous FTP, and permission-based directory visibility. Problem description: bzip2 - SECURITY Fix: Command injection vulnerability in the "bzgrep" - bzgrep did not handle shell metacharacters like '|' and '&' properly when they occurred in input file names. This could be exploited to execute arbitrary commands with user privileges if bzgrep was run in an untrusted directory with specially crafted file names. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-0758 to this issue. perl-compress-zlib - New upstream. - SECURITY Fix: Previous version of Compress::Zlib contains a local vulnerable version of zlib, which may lead to a buffer overflow. (CAN-2005-1849). proftpd - SECURITY Fix: Format string vulnerabilities - Two vulnerabilities have been reported in ProFTPD, which can be exploited by malicious users to disclose certain sensitive information, cause a DoS (Denial of Service), or potentially compromise a vulnerable system. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-2390 to this issue. Action: We recommend that all systems with this package installed be upgraded. Please note that if you do not need the functionality provided by this package, you may want to remove it from your system. Location: All Trustix Secure Linux updates are available from About Trustix Secure Linux: Trustix Secure Linux is a small Linux distribution for servers. With focus on security and stability, the system is painlessly kept safe and up to date from day one using swup, the automated software updater. Automatic updates: Users of the SWUP tool can enjoy having updates automatically installed using 'swup --upgrade'. Questions? Check out our mailing lists: Verification: This advisory along with all Trustix packages are signed with the TSL sign key. This key is available from: The advisory itself is available from the errata pages at and or directly at MD5sums of the packages: - -------------------------------------------------------------------------- c57a14ddc70dc381eea83b48d2698f22 3.0/rpms/bzip2-1.0.3-4tr.i586.rpm 3ad903577196558e5ce8efd602752257 3.0/rpms/bzip2-devel-1.0.3-4tr.i586.rpm 6bf458dd6edad3086a0c122e80f179cd 3.0/rpms/bzip2-libs-1.0.3-4tr.i586.rpm fce91bc96bb5716a8518ec9c32e9d406 3.0/rpms/perl-compress-zlib-1.35-1tr.i586.rpm b8a15769fa994e12a9416180fc01c495 3.0/rpms/proftpd-1.2.10-9tr.i586.rpm 114904521848d54ea07c8225d05c4e2e 2.2/rpms/bzip2-1.0.3-3tr.i586.rpm 21410bd75ce00fe486080777c0ba95f8 2.2/rpms/bzip2-devel-1.0.3-3tr.i586.rpm bb79cd2198cc9a323639ff6188cd5fd9 2.2/rpms/bzip2-libs-1.0.3-3tr.i586.rpm 5a9be0817c3fb7aea5a74e62051edb74 2.2/rpms/perl-compress-zlib-1.35-1tr.i586.rpm 1b12b65524f9c4caa88523c81388853a 2.2/rpms/proftpd-1.2.10-9tr.i586.rpm - -------------------------------------------------------------------------- Trustix Security Team -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.1 (GNU/Linux) iD8DBQFC85ahi8CEzsK9IksRArGxAKCpE2L7xpuqtydUUziV+uceT3YtKQCff/GD +NtJ9EdUZADkzxlQfjMx0dU= =0aeZ -----END PGP SIGNATURE-----