From security-announce@turbolinux.co.jp Tue Sep 30 06:15:44 2003 From: Turbolinux Resent-From: security-announce@turbolinux.co.jp To: security-announce@turbolinux.co.jp Resent-To: server-users-e@turbolinux.co.jp (moderated) Date: Tue, 30 Sep 2003 18:18:02 +0900 Reply-To: server-users-e@turbolinux.co.jp Subject: [Full-Disclosure] [TURBOLINUX SECURITY INFO] 30/Sep/2003 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 This is an announcement only email list for the x86 architecture. ============================================================ Turbolinux Security Announcement 30/Sep/2003 ============================================================ The following page contains the security information of Turbolinux Inc. - Turbolinux Security Center http://www.turbolinux.com/security/ (1) proftpd -> ASCII File Remote Compromise Vulnerability =========================================================== * proftpd -> ASCII File Remote Compromise Vulnerability =========================================================== More information : ProFTPD grew out of the desire to have a secure and configurable FTP server, and out of a significant admiration of the Apache web server. There are currently a very limited number of FTP servers running on Unix (or Unix-like) hosts. A vulnerability exists in the ProFTPD server that can be triggered by remote attackers when transferring files from the FTP server in ASCII mode. The attacker must have the ability to upload a file to the server, and then attempt to download the same file to trigger the vulnerability. Impact : This vulnerability may allow a remote attacker to execute arbitrary code. Affected Products : - Turbolinux 8 Server - Turbolinux 8 Workstation - Turbolinux 7 Server - Turbolinux 7 Workstation - Turbolinux Server 6.5 Solution : Please use turbopkg(zabom) tool to apply the update. --------------------------------------------- # turbopkg or # zabom update proftpd --------------------------------------------- Source Packages Size : MD5 ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/8/updates/SRPMS/proftpd-1.2.8-3.src.rpm 799310 0b085b2534d2ef187190e28c0d3c82b0 Binary Packages Size : MD5 ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/8/updates/RPMS/proftpd-1.2.8-3.i586.rpm 494255 41ef87d4add81c3e9b6b5798f0f5e53b Source Packages Size : MD5 ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Workstation/8/updates/SRPMS/proftpd-1.2.8-3.src.rpm 799310 c7c4ba58a0f45c9aa9ec37e71415683d Binary Packages Size : MD5 ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Workstation/8/updates/RPMS/proftpd-1.2.8-3.i586.rpm 494317 aff059772cb4e8a83626165af3c2c918 Source Packages Size : MD5 ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/7/updates/SRPMS/proftpd-1.2.8-3.src.rpm 799310 725dc29f67cab5fa77a236154033b3c7 Binary Packages Size : MD5 ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/7/updates/RPMS/proftpd-1.2.8-3.i586.rpm 486609 fc1a2b813257322095e6303dc4c27799 Source Packages Size : MD5 ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Workstation/7/updates/SRPMS/proftpd-1.2.8-3.src.rpm 799310 a3d08e2e400f57b66fd7c2022abd1d09 Binary Packages Size : MD5 ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Workstation/7/updates/RPMS/proftpd-1.2.8-3.i586.rpm 486725 67f5f2f278a25548fd5424d5c481e151 Source Packages Size : MD5 ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/6.5/updates/SRPMS/proftpd-1.2.8-3.src.rpm 799310 28b82c94e03161660db0a061e272b3cd Binary Packages Size : MD5 ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/6.5/updates/RPMS/proftpd-1.2.8-3.i386.rpm 597007 830ce6d43eefabe6f52333fd34d52a98 Notice : After performing the update, it is necessary to restart the proftpd daemon. To do this, run the following command as user root. --------------------------------------------- # /etc/init.d/proftpd restart or # /etc/rc.d/init.d/proftpd restart --------------------------------------------- References : ProFTPD org [News Flashes] http://www.proftpd.org/index.html CVE [CAN-2003-0831] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0831 -------------------------------------------------------------------------- Revision History 30 Sep 2003 Initial release -------------------------------------------------------------------------- * You may need to update the turbopkg tool before applying the update. Please refer to the following URL for detailed information. http://www.turbolinux.com/download/zabom.html http://www.turbolinux.com/download/zabomupdate.html Package Update Path http://www.turbolinux.com/update ============================================================ * To obtain the public key Here is the public key http://www.turbolinux.com/security/ * To unsubscribe from the list If you ever want to remove yourself from this mailing list, you can send a message to with the word `unsubscribe' in the body (don't include the quotes). unsubscribe * To change your email address If you ever want to chage email address in this mailing list, you can send a message to with the following command in the message body: chaddr 'old address' 'new address' If you have any questions or problems, please contact Thank you! -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.3 (GNU/Linux) iD8DBQE/eUpeK0LzjOqIJMwRAgHMAKC1xePRCUT7zjP0zzrz+kh2QUfU1wCgkkFn 6W/tCuVbAJHn3Dm34MAe8UA= =CZXF -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html