<<< Date Index >>>     <<< Thread Index >>>

[CLA-2003:771] Conectiva Security Announcement - anonftp



-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- --------------------------------------------------------------------------
CONECTIVA LINUX SECURITY ANNOUNCEMENT 
- --------------------------------------------------------------------------

PACKAGE   : anonftp
SUMMARY   : Remote denial of service vulnerability
DATE      : 2003-10-24 14:49:00
ID        : CLA-2003:771
RELEVANT
RELEASES  : 7.0, 8, 9

- -------------------------------------------------------------------------

DESCRIPTION
 The anonftp package contains a chroot environment used by some FTP
 servers (e. g. wu-ftpd) when serving anonymous FTP sessions. Among
 the utilities provided, is the "ls" program, used to list information
 about files and directories.
 
 This update is a follow-up to the CLSA-2003:768 announcement[1],
 which fixed a memory starvation vulnerability in the ls program (from
 the fileutils package). Since the anonftp package contains a copy of
 the ls program, it is also being updated. Below is a copy of our
 previous text describing the vulnerability:
 
 Georgi Guninski discovered[2] a memory starvation denial of service
 vulnerability in the ls program. It is possible to make ls allocate a
 huge amount of memory by calling it with the parameters "-w X -C"
 (where X is an arbitrary large number). The Common Vulnerabilities
 and Exposures project (cve.mitre.org) has assigned the name
 CAN-2003-0854[3] to this issue.
 
 This vulnerability is remotely exploitable in scenarios where remote
 applications allow users to call ls without filtering the supplied
 parameters. An example of such a scenario is the use of the wu-ftpd
 FTP server.
 
 Additionally, this update fixes an integer overflow in ls which seems
 to be non-exploitable. The overflow occurs in the usage of the "-w"
 parameter under the same circumstances of the aforementioned memory
 starvation vulnerability. The Common Vulnerabilities and Exposures
 project (cve.mitre.org) has assigned the name CAN-2003-0853[4] to
 this issue.


SOLUTION
 All users of the anonftp package should upgrade.
 
 
 REFERENCES
 
1.http://distro.conectiva.com.br/atualizacoes/index.php?id=a&anuncio=000768&idioma=en
 2.http://www.guninski.com/binls.html
 3.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0854
 4.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0853


UPDATED PACKAGES
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/anonftp-3.0-7U70_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/SRPMS/anonftp-3.0-7U70_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/anonftp-3.0-9U80_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/SRPMS/anonftp-3.0-9U80_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/anonftp-3.0-22686U90_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/SRPMS/anonftp-3.0-22686U90_2cl.src.rpm


ADDITIONAL INSTRUCTIONS
 The apt tool can be used to perform RPM packages upgrades:

 - run:                 apt-get update
 - after that, execute: apt-get upgrade

 Detailed instructions reagarding the use of apt and upgrade examples 
 can be found at http://distro.conectiva.com.br/atualizacoes/#apt?idioma=en

- -------------------------------------------------------------------------
All packages are signed with Conectiva's GPG key. The key and instructions
on how to import it can be found at 
http://distro.conectiva.com.br/seguranca/chave/?idioma=en
Instructions on how to check the signatures of the RPM packages can be
found at http://distro.conectiva.com.br/seguranca/politica/?idioma=en

- -------------------------------------------------------------------------
All our advisories and generic update instructions can be viewed at
http://distro.conectiva.com.br/atualizacoes/?idioma=en

- -------------------------------------------------------------------------
Copyright (c) 2003 Conectiva Inc.
http://www.conectiva.com

- -------------------------------------------------------------------------
subscribe: conectiva-updates-subscribe@xxxxxxxxxxxxxxxxxxxxxxxxxxx
unsubscribe: conectiva-updates-unsubscribe@xxxxxxxxxxxxxxxxxxxxxxxxxxx
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org

iD8DBQE/mVoC42jd0JmAcZARAlS4AKDWB6D3ct6gIoAud/2kp8iLxa1zOwCdEO13
/Pq7zEZpidAqTkRrYhLdiHE=
=zS3P
-----END PGP SIGNATURE-----