-------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2013-0468 2013-01-09 08:16:42 --------------------------------------------------------------------------------
Name : proftpd Product : Fedora 16 Version : 1.3.4b Release : 5.fc16 URL : http://www.proftpd.org/ Summary : Flexible, stable and highly-configurable FTP server Description : ProFTPD is an enhanced FTP server with a focus toward simplicity, security, and ease of configuration. It features a very Apache-like configuration syntax, and a highly customizable server infrastructure, including support for multiple 'virtual' FTP servers, anonymous FTP, and permission-based directory visibility.
This package defaults to the standalone behavior of ProFTPD, but all the needed scripts to have it run by xinetd instead are included.
-------------------------------------------------------------------------------- Update Information:
Jann Horn reported that there is a possible race condition in the handling of the MKD/XMKD FTP commands, when the UserOwner directive is involved, and the attacker is on the same physical machine as a running proftpd. This race applies to mod_sftp and the handling of the MKDIR SFTP request as well.
Note that using the DefaultRoot directive to restrict sessions mitigates this attack, since the symlinks created by the local attacker will point outside of the chroot(2) area within the FTP session, and thus the ownership change will fail. The default configuration in Fedora applies the DefaultRoot directive to all users except "adm".
The upstream reference for this issue is: http://bugs.proftpd.org/show_bug.cgi?id=3841
This update includes upstream's backport to proftpd 1.3.4 of the fix for this issue. -------------------------------------------------------------------------------- ChangeLog:
* Wed Jan 16 2013 Paul Howarth paul@city-fan.org 1.3.4b-5 - Update patch for CVE-2012-6095 to cover vroot cases * Mon Jan 7 2013 Paul Howarth paul@city-fan.org 1.3.4b-4 - Fix possible symlink race when applying UserOwner to newly created directory (CVE-2012-6095, #892715, http://bugs.proftpd.org/show_bug.cgi?id=3841) * Sat Sep 22 2012 Remi Collet remi@fedoraproject.org 1.3.4b-3 - Rebuild against libmemcached.so.11 without SASL * Thu Aug 30 2012 Paul Howarth paul@city-fan.org 1.3.4b-2 - Add support for systemd presets in Fedora 18+ (#850281) * Wed Aug 1 2012 Paul Howarth paul@city-fan.org 1.3.4b-1 - Update to 1.3.4b - Fixed mod_ldap segfault on login when LDAPUsers with no filters used - Fixed sporadic SFTP upload issues for large files - Fixed SSH2 handling for some clients (e.g. OpenVMS) - New FactsOptions directive; see doc/modules/mod_facts.html#FactsOptions - Fixed build errors on Tru64, AIX, Cygwin - Lots of bugs fixed - see NEWS for details - No bzipped tarball release this time, so revert to gzipped one - Drop patches for fixes included in upstream release * Sat Jul 21 2012 Fedora Release Engineering rel-eng@lists.fedoraproject.org 1.3.4a-11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild * Tue Jul 3 2012 Paul Howarth paul@city-fan.org 1.3.4a-10 - Move tmpfiles.d file from %{_sysconfdir} to %{_prefix}/lib * Sat Apr 21 2012 Paul Howarth paul@city-fan.org 1.3.4a-9 - Rebuild for new libmemcached in Rawhide * Fri Apr 13 2012 Paul Howarth paul@city-fan.org 1.3.4a-8 - Do hardened (PIE) builds where possible - Drop %defattr, redundant since rpm 4.4 - Always look for TLS certs in /etc/pki/tls/certs * Mon Mar 12 2012 Paul Howarth paul@city-fan.org 1.3.4a-7 - Tweak logrotate script for systemd compatibility (#802178) - Fix leaked file descriptors for log files (as per bug 3751) * Sat Mar 3 2012 Paul Howarth paul@city-fan.org 1.3.4a-6 - Rebuild for new libmemcached in Rawhide * Tue Feb 28 2012 Paul Howarth paul@city-fan.org 1.3.4a-5 - Document SELinux configuration for ProFTPD in proftpd.conf (#785443) - Add support for basic and administrative controls actions using ftpdctl by default (#786623) - Add trace logging directives in proftpd.conf but disable them by default as they impair performance - Fix ftpwho/ftptop not showing command arguments (bug 3714) - Fix MLSD/MLST fail with "DirFakeUser off" or "DirFakeGroup off" (bug 3715) - Fix proftpd fails to run with "Abort trap" error message (bug 3717) - Fix LIST -R can loop endlessly if bad directory symlink exists (bug 3719) - Fix overly restrictive module logfile permissions (bug 3720) - Fix mod_memcache segfault on server restart (bug 3723) - Fix unloading mod_quotatab causes segfault (#757311, bug 3724) - Fix mod_exec does not always capture stdout/stderr output from executed command (bug 3726) - Fix mod_wrap2 causes unexpected LogFormat %u expansion for SFTP connections (bug 3727) - Fix mod_ldap segfault when LDAPUsers is used with no optional filters (bug 3729) - Fix DirFakeUser/DirFakeGroup off with name causes SIGSEGV for MLSD/MLST commands (bug 3734) - Fix improper handling of self-signed certificate in client-sent cert list when "TLSVerifyClient on" is used (bug 3742) - Fix random stalls/segfaults seen when transferring large files via SFTP (bug 3743) - Support ls(1) -1 option for LIST command (bug 3744) - Reject PASV command if no IPv4 address available (bug 3745) - Support applying ListOptions only to NLST or to LIST commands (bug 3746) - Support option for displaying symlinks via MLSD using syntax preferred by FileZilla (bug 3747) - Fix mod_ban not closing and reopening the BanLog/BanTable file descriptors on restart, causing a file descriptor leak (bug 3751) - Fix mod_ctrls no longer listening on ControlsSocket after restart (bug 3756) * Thu Feb 9 2012 Paul Howarth paul@city-fan.org 1.3.4a-4 - Rebuild for new libpcre in Rawhide * Mon Jan 16 2012 Paul Howarth paul@city-fan.org 1.3.4a-3 - Add -utils subpackage for support tools, which means the main package no longer requires perl * Tue Jan 10 2012 Paul Howarth paul@city-fan.org 1.3.4a-2 - Make mod_vroot a DSO, loaded by default (#772354) - VRootAlias for /etc/security/pam_env.conf is redundant, so remove it - Add BanMessage (#772354) - Add -devel subpackage for building third-party modules * Fri Nov 11 2011 Paul Howarth paul@city-fan.org 1.3.4a-1 - Update to 1.3.4a: - Fixed mod_load/mod_wrap2 build issues - Drop now-redundant workaround for building mod_load and mod_wrap2 - Drop upstreamed patch for xinetd config typo * Thu Nov 10 2011 Paul Howarth paul@city-fan.org 1.3.4-1 - Update to 1.3.4, addressing the following bugs since 1.3.4rc3: - ProFTPD with mod_sql_mysql dies of "Alarm clock" on FreeBSD (bug 3702) - mod_sql_mysql.so: undefined symbol: make_scrambled_password with MySQL 5.5 on Fedora (bug 3669) - PQescapeStringConn() needs a better check (bug 3192) - Enable OpenSSL countermeasure against SSLv3/TLSv1 BEAST attacks (bug 3704); to disable this countermeasure, which may cause interoperability issues with some clients, use the NoEmptyFragments TLSOption - Support SFTPOption for ignoring requests to modify timestamps (bug 3706) - RPM build on CentOS 5.5 (64bit): "File not found by glob" (bug 3640) - Response pool use-after-free memory corruption error (bug 3711, #752812, ZDI-CAN-1420, CVE-2011-4130) - Drop upstream patch for make_scrambled_password_323 - Use upstream SysV initscript rather than our own - Use upstream systemd service file rather than our own - Use upstream PAM configuration rather than our own - Use upstream logrotate configuration rather than our own - Use upstream tempfiles configuration rather than our own - Use upstream xinetd configuration rather than our own -------------------------------------------------------------------------------- References:
[ 1 ] Bug #892715 - CVE-2012-6095 proftpd: Symlink race condition when applying UserOwner to a newly (ProFTPD) created directory https://bugzilla.redhat.com/show_bug.cgi?id=892715 --------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use su -c 'yum update proftpd' at the command line. For more information, refer to "Managing Software with yum", available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys --------------------------------------------------------------------------------