Bugtraq mailing list archives
TSLSA-2004-0025 - multi
From: Trustix Security Advisor <tsl () trustix org>
Date: Fri, 30 Apr 2004 16:17:50 +0200
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Trustix Secure Linux Security Advisory #2004-0025 Package name: libpng proftpd Summary: Potential security holes Date: 2004-04-30 Affected versions: Trustix Secure Linux 2.0 Trustix Secure Linux 2.1 Trustix Secure Enterprise Linux 2 - -------------------------------------------------------------------------- Package description: libpng: A library of functions for creating and manipulating PNG (Portable Network Graphics) image format files. proftpd: An enhanced FTP server with a focus toward simplicity, security, and ease of configuration. It features a very Apache-like configuration syntax, and a highly customizable server infrastructure, including support for multiple 'virtual' FTP servers, anonymous FTP, and permission-based directory visibility. Problem description: libpng: Steve Grubb discovered that libpng would access memory that is out of bounds when creating an error message. The impact of this bug is not clear, but it could lead to a core dump in a program using libpng, or could result in a DoS (Denial of Service) condition in a daemon that uses libpng to process PNG images. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0421 to this issue. proftpd: A portability workaround was applied in version 1.2.9 of the FTP server ProFTPD. As a side-effect, CIDR based (aaa.bbb.ccc.ddd/NN) ACL entries in "Allow" and "Deny" directives act like a "AllowAll" directive and so FTP clients are granted access to files and directories although the server configuration explicitly deny this access. This issue only affects proftpd 1.2.9, which is shipped with Trustix Secure Linux 2.1 and Trustix Secure Enterprise Linux 2. Trustix Secure Linux 2.0 uses proftpd 1.2.8, and is NOT affected by this issue. Action: We recommend that all systems with this package installed be upgraded. Please note that if you do not need the functionality provided by this package, you may want to remove it from your system. Location: All Trustix Secure Linux updates are available from <URI:http://http.trustix.org/pub/trustix/updates/> <URI:ftp://ftp.trustix.org/pub/trustix/updates/> About Trustix Secure Linux: Trustix Secure Linux is a small Linux distribution for servers. With focus on security and stability, the system is painlessly kept safe and up to date from day one using swup, the automated software updater. Automatic updates: Users of the SWUP tool can enjoy having updates automatically installed using 'swup --upgrade'. Public testing: Most updates for Trustix Secure Linux are made available for public testing some time before release. If you want to contribute by testing the various packages in the testing tree, please feel free to share your findings on the tsl-discuss mailinglist. The testing tree is located at <URI:http://tsldev.trustix.org/horizon/> You may also use swup for public testing of updates: site { class = 0 location = "http://tsldev.trustix.org/horizon/rdfs/latest.rdf" regexp = ".*" } Questions? Check out our mailing lists: <URI:http://www.trustix.org/support/> Verification: This advisory along with all Trustix packages are signed with the TSL sign key. This key is available from: <URI:http://www.trustix.org/TSL-SIGN-KEY> The advisory itself is available from the errata pages at <URI:http://www.trustix.org/errata/trustix-2.0/> and <URI:http://www.trustix.org/errata/trustix-2.1/> or directly at <URI:http://www.trustix.org/errata/misc/2004/TSL-2004-0025-multi.asc.txt> MD5sums of the packages: - -------------------------------------------------------------------------- 62bd819bba0cff8a9507d8fa46b43d55 TSEL-2/libpng-1.2.5-9tr.i586.rpm 5bed4b3d9285c8b46b70bb062b9e8c25 TSEL-2/libpng-devel-1.2.5-9tr.i586.rpm 72c1f469310c9feeb1ab278d385578b0 TSEL-2/libpng-tools-1.2.5-9tr.i586.rpm 549de5b6837cf56088320ecc68655a0a TSEL-2/proftpd-1.2.9-7tr.i586.rpm 082cb022028baef72bd90dd6ccb9d5de 2.1/rpms/libpng-1.2.5-9tr.i586.rpm d421874e6cd70ddb80f5fa2008ea3e8b 2.1/rpms/libpng-devel-1.2.5-9tr.i586.rpm 6576f73e5a336e1649e31f65481172d3 2.1/rpms/libpng-tools-1.2.5-9tr.i586.rpm 3ad72fe97c3cdd1ae3a3dc9d177719c9 2.1/rpms/proftpd-1.2.9-7tr.i586.rpm 24541a0458eaf894050b64bc02f2ab5f 2.0/rpms/libpng12-1.2.5-4tr.i586.rpm 61609475829abcf2a4246557fc1e2d30 2.0/rpms/libpng12-devel-1.2.5-4tr.i586.rpm - -------------------------------------------------------------------------- Trustix Security Team -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.2 (GNU/Linux) iD8DBQFAkll+i8CEzsK9IksRAu68AKCUh9It0ZFcHcR+qv4KHG4OeWRLmQCgtqPl P/OIsQdWeCnuQXN8k3FNm2w= =YHUi -----END PGP SIGNATURE-----
Current thread:
- TSLSA-2004-0025 - multi Trustix Security Advisor (Apr 30)