[SECURITY] Fedora EPEL 6 Update: proftpd-1.3.3e-1.el6
updates at fedoraproject.org
updates at fedoraproject.org
Sat Apr 23 18:26:10 UTC 2011
--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2011-3016
2011-04-08 20:02:40
--------------------------------------------------------------------------------
Name : proftpd
Product : Fedora EPEL 6
Version : 1.3.3e
Release : 1.el6
URL : http://www.proftpd.org/
Summary : Flexible, stable and highly-configurable FTP server
Description :
ProFTPD is an enhanced FTP server with a focus toward simplicity, security,
and ease of configuration. It features a very Apache-like configuration
syntax, and a highly customizable server infrastructure, including support for
multiple 'virtual' FTP servers, anonymous FTP, and permission-based directory
visibility.
This package defaults to the standalone behavior of ProFTPD, but all the
needed scripts to have it run by xinetd instead are included.
--------------------------------------------------------------------------------
Update Information:
This update, to the current upstream maintenance release, fixes a large number of bugs (see NEWS for details), and also a couple of security issues:
* Plaintext command injection vulnerability in FTPS implementation (i.e. mod_tls). See http://bugs.proftpd.org/show_bug.cgi?id=3624 for details.
* CVE-2011-1137 (badly formed SSH messages cause DoS). See http://bugs.proftpd.org/show_bug.cgi?id=3586 for details.
Other highlights include:
* Display messages work properly again.
* Performance improvements, especially during server startup/restarts.
* mod_vroot updated to 0.9.2 (latest release)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #681718 - CVE-2011-1137 proftpd: integer overflow in mod_sftp
https://bugzilla.redhat.com/show_bug.cgi?id=681718
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update proftpd' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
More information about the epel-package-announce
mailing list