(Trustix Issues Fix) ProFTPD Access Control Bug With CIDR Addresses May Let Remote Authenticated Users Access Files
|
|
SecurityTracker Alert ID: 1009999 |
|
SecurityTracker URL: http://securitytracker.com/id/1009999
|
|
CVE Reference:
GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Apr 30 2004
|
Impact:
Disclosure of user information
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): 1.2.9 to prior to 1.2.10rc1
|
Description:
A vulnerability was reported in ProFTPD. A remote authenticated user may be able to gain access to files when certain access control restrictions fail.
Jindrich Makovicka reported that access control list entries that use CIDR-based addresses (of the form 'aaa.bbb.ccc.ddd/NN') may be incorrectly processed as an 'AllowAll' directive, regardless of whether the stated directive is to allow or deny. As a result, a remote authenticated user may be able to gain access to ostensibly restricted files and directories.
The flaw reportedly resides in 'proftpd/src/dirtree.c' and was introduced into ProFTPD in version 1.2.9.
|
Impact:
A remote authenticated user may be able to gain access to access-restricted files or directories.
|
Solution:
Trustix has released a fix, available at:
http://http.trustix.org/pub/trustix/updates/
ftp://ftp.trustix.org/pub/trustix/updates/
The MD5sums of the packages are:
549de5b6837cf56088320ecc68655a0a TSEL-2/proftpd-1.2.9-7tr.i586.rpm
3ad72fe97c3cdd1ae3a3dc9d177719c9 2.1/rpms/proftpd-1.2.9-7tr.i586.rpm
|
Vendor URL: bugs.proftpd.org/show_bug.cgi?id=2267 (Links to External Site)
|
Cause:
Access control error
|
Underlying OS:
Linux (Trustix)
|
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
Date: Fri, 30 Apr 2004 16:18:22 +0200
Subject: TSLSA-2004-0025 - multi
|
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- --------------------------------------------------------------------------
Trustix Secure Linux Security Advisory #2004-0025
Package name: libpng proftpd
Summary: Potential security holes
Date: 2004-04-30
Affected versions: Trustix Secure Linux 2.0
Trustix Secure Linux 2.1
Trustix Secure Enterprise Linux 2
- --------------------------------------------------------------------------
Package description:
libpng:
A library of functions for creating and manipulating PNG
(Portable Network Graphics) image format files.
proftpd:
An enhanced FTP server with a focus toward simplicity, security,
and ease of configuration. It features a very Apache-like configuration
syntax, and a highly customizable server infrastructure, including
support for multiple 'virtual' FTP servers, anonymous FTP, and
permission-based directory visibility.
Problem description:
libpng:
Steve Grubb discovered that libpng would access memory that is out of
bounds when creating an error message. The impact of this bug is not
clear, but it could lead to a core dump in a program using libpng, or
could result in a DoS (Denial of Service) condition in a daemon that
uses libpng to process PNG images.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CAN-2004-0421 to this issue.
proftpd:
A portability workaround was applied in version 1.2.9 of the FTP
server ProFTPD. As a side-effect, CIDR based (aaa.bbb.ccc.ddd/NN)
ACL entries in "Allow" and "Deny" directives act like a "AllowAll"
directive and so FTP clients are granted access to files and
directories although the server configuration explicitly deny this
access.
This issue only affects proftpd 1.2.9, which is shipped with Trustix
Secure Linux 2.1 and Trustix Secure Enterprise Linux 2. Trustix Secure
Linux 2.0 uses proftpd 1.2.8, and is NOT affected by this issue.
Action:
We recommend that all systems with this package installed be upgraded.
Please note that if you do not need the functionality provided by this
package, you may want to remove it from your system.
Location:
All Trustix Secure Linux updates are available from
<URI:http://http.trustix.org/pub/trustix/updates/>
<URI:ftp://ftp.trustix.org/pub/trustix/updates/>
About Trustix Secure Linux:
Trustix Secure Linux is a small Linux distribution for servers. With focus
on security and stability, the system is painlessly kept safe and up to
date from day one using swup, the automated software updater.
Automatic updates:
Users of the SWUP tool can enjoy having updates automatically
installed using 'swup --upgrade'.
Public testing:
Most updates for Trustix Secure Linux are made available for public
testing some time before release.
If you want to contribute by testing the various packages in the
testing tree, please feel free to share your findings on the
tsl-discuss mailinglist.
The testing tree is located at
<URI:http://tsldev.trustix.org/horizon/>
You may also use swup for public testing of updates:
site {
class = 0
location = "http://tsldev.trustix.org/horizon/rdfs/latest.rdf"
regexp = ".*"
}
Questions?
Check out our mailing lists:
<URI:http://www.trustix.org/support/>
Verification:
This advisory along with all Trustix packages are signed with the
TSL sign key.
This key is available from:
<URI:http://www.trustix.org/TSL-SIGN-KEY>
The advisory itself is available from the errata pages at
<URI:http://www.trustix.org/errata/trustix-2.0/> and
<URI:http://www.trustix.org/errata/trustix-2.1/>
or directly at
<URI:http://www.trustix.org/errata/misc/2004/TSL-2004-0025-multi.asc.txt>
MD5sums of the packages:
- --------------------------------------------------------------------------
62bd819bba0cff8a9507d8fa46b43d55 TSEL-2/libpng-1.2.5-9tr.i586.rpm
5bed4b3d9285c8b46b70bb062b9e8c25 TSEL-2/libpng-devel-1.2.5-9tr.i586.rpm
72c1f469310c9feeb1ab278d385578b0 TSEL-2/libpng-tools-1.2.5-9tr.i586.rpm
549de5b6837cf56088320ecc68655a0a TSEL-2/proftpd-1.2.9-7tr.i586.rpm
082cb022028baef72bd90dd6ccb9d5de 2.1/rpms/libpng-1.2.5-9tr.i586.rpm
d421874e6cd70ddb80f5fa2008ea3e8b 2.1/rpms/libpng-devel-1.2.5-9tr.i586.rpm
6576f73e5a336e1649e31f65481172d3 2.1/rpms/libpng-tools-1.2.5-9tr.i586.rpm
3ad72fe97c3cdd1ae3a3dc9d177719c9 2.1/rpms/proftpd-1.2.9-7tr.i586.rpm
24541a0458eaf894050b64bc02f2ab5f 2.0/rpms/libpng12-1.2.5-4tr.i586.rpm
61609475829abcf2a4246557fc1e2d30 2.0/rpms/libpng12-devel-1.2.5-4tr.i586.rpm
- --------------------------------------------------------------------------
Trustix Security Team
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (GNU/Linux)
iD8DBQFAkll+i8CEzsK9IksRAu68AKCUh9It0ZFcHcR+qv4KHG4OeWRLmQCgtqPl
P/OIsQdWeCnuQXN8k3FNm2w=
=YHUi
-----END PGP SIGNATURE-----
_______________________________________________
tsl-announce mailing list
tsl-announce@lists.trustix.org
http://lists.trustix.org/mailman/listinfo/tsl-announce
|
|
