SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (File Transfer/Sharing)  >   ProFTPD Vendors:   ProFTPd
(TurboLinux Issues Fix) Re: ProFTPD ASCII Mode File Upload Buffer Overflow Lets Certain Remote Users Execute Arbitrary Code
SecurityTracker Alert ID:  1007946
SecurityTracker URL:  http://securitytracker.com/id/1007946
CVE Reference:   CVE-2003-0831   (Links to External Site)
Date:  Oct 17 2003
Impact:   Execution of arbitrary code via network, Root access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): Confirmed on 1.2.7, 1.2.8, 1.2.8rc1, 1.2.8rc2, 1.2.9rc1, and 1.2.9rc2
Description:   A buffer overflow vulnerability was reported in the ProFTPD FTP server. A remote user with upload privileges may be able to obtain root access on the target system.

Internet Security Systems reported that there is a flaw in the processing of inbound ASCII file transfers. A remote user with upload privileges can upload a specially crafted file in ASCII mode and then attempt to download the file to trigger the buffer overflow and execute arbitrary code. The remote user can bypass ProFTPD security checks to cause the code to execute with root level privileges, the report said.

According to the report, the flaw resides in the translation of newline characters.

The CVE number CVE-2003-0831 has been assigned to this issue.

Impact:   A remote user with file upload privileges can execute arbitrary code on the target system with root privileges.
Solution:   TurboLinux has issued a fix. See the Source Message for directions on how to apply the fix.

<Turbolinux 8 Server>

Source Packages
Size : MD5

ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/8/updates/SRPMS/proftpd-1.2.8-3.src.rpm
799310 0b085b2534d2ef187190e28c0d3c82b0

Binary Packages
Size : MD5

ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/8/updates/RPMS/proftpd-1.2.8-3.i586.rpm
494255 41ef87d4add81c3e9b6b5798f0f5e53b

<Turbolinux 8 Workstation>

Source Packages
Size : MD5

ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Workstation/8/updates/SRPMS/proftpd-1.2.8-3.src.rpm
799310 c7c4ba58a0f45c9aa9ec37e71415683d

Binary Packages
Size : MD5

ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Workstation/8/updates/RPMS/proftpd-1.2.8-3.i586.rpm
494317 aff059772cb4e8a83626165af3c2c918

<Turbolinux 7 Server>

Source Packages
Size : MD5

ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/7/updates/SRPMS/proftpd-1.2.8-3.src.rpm
799310 725dc29f67cab5fa77a236154033b3c7

Binary Packages
Size : MD5

ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/7/updates/RPMS/proftpd-1.2.8-3.i586.rpm
486609 fc1a2b813257322095e6303dc4c27799

<Turbolinux 7 Workstation>

Source Packages
Size : MD5

ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Workstation/7/updates/SRPMS/proftpd-1.2.8-3.src.rpm
799310 a3d08e2e400f57b66fd7c2022abd1d09

Binary Packages
Size : MD5

ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Workstation/7/updates/RPMS/proftpd-1.2.8-3.i586.rpm
486725 67f5f2f278a25548fd5424d5c481e151

<Turbolinux Server 6.5>

Source Packages
Size : MD5

ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/6.5/updates/SRPMS/proftpd-1.2.8-3.src.rpm
799310 28b82c94e03161660db0a061e272b3cd

Binary Packages
Size : MD5

ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/6.5/updates/RPMS/proftpd-1.2.8-3.i386.rpm
597007 830ce6d43eefabe6f52333fd34d52a98

Vendor URL:  www.proftpd.org/ (Links to External Site)
Cause:   Boundary error
Underlying OS:  Linux (Turbo Linux)
Underlying OS Comments:  6.5, 7, 8

Message History:   This archive entry is a follow-up to the message listed below.
Sep 23 2003 ProFTPD ASCII Mode File Upload Buffer Overflow Lets Certain Remote Users Execute Arbitrary Code



 Source Message Contents

Subject:  [Full-Disclosure] [TURBOLINUX SECURITY INFO] 30/Sep/2003


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

This is an announcement only email list for the x86 architecture.
============================================================
Turbolinux Security Announcement 30/Sep/2003
============================================================

The following page contains the security information of Turbolinux Inc.

 - Turbolinux Security Center
   http://www.turbolinux.com/security/

 (1) proftpd -> ASCII File Remote Compromise Vulnerability


===========================================================
* proftpd -> ASCII File Remote Compromise Vulnerability
===========================================================

More information :
    ProFTPD grew out of the desire to have a secure and configurable FTP server,
    and out of a significant admiration of the Apache web server.
    There are currently a very limited number of FTP servers running on Unix (or Unix-like) hosts. 
    A vulnerability exists in the ProFTPD server that can be triggered by
    remote attackers when transferring files from the FTP server in ASCII mode.
    The attacker must have the ability to upload a file to the server,
    and then attempt to download the same file to trigger the vulnerability.

 Impact :
    This vulnerability may allow a remote attacker to execute arbitrary code.

 Affected Products :
    - Turbolinux 8 Server
    - Turbolinux 8 Workstation
    - Turbolinux 7 Server
    - Turbolinux 7 Workstation
    - Turbolinux Server 6.5


 Solution :
    Please use turbopkg(zabom) tool to apply the update.
 ---------------------------------------------
 # turbopkg
 or
 # zabom update proftpd
 ---------------------------------------------


 <Turbolinux 8 Server>

   Source Packages
   Size : MD5

   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/8/updates/SRPMS/proftpd-1.2.8-3.src.rpm
       799310 0b085b2534d2ef187190e28c0d3c82b0

   Binary Packages
   Size : MD5

   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/8/updates/RPMS/proftpd-1.2.8-3.i586.rpm
       494255 41ef87d4add81c3e9b6b5798f0f5e53b

 <Turbolinux 8 Workstation>

   Source Packages
   Size : MD5

   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Workstation/8/updates/SRPMS/proftpd-1.2.8-3.src.rpm
       799310 c7c4ba58a0f45c9aa9ec37e71415683d

   Binary Packages
   Size : MD5

   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Workstation/8/updates/RPMS/proftpd-1.2.8-3.i586.rpm
       494317 aff059772cb4e8a83626165af3c2c918

 <Turbolinux 7 Server>

   Source Packages
   Size : MD5

   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/7/updates/SRPMS/proftpd-1.2.8-3.src.rpm
       799310 725dc29f67cab5fa77a236154033b3c7

   Binary Packages
   Size : MD5

   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/7/updates/RPMS/proftpd-1.2.8-3.i586.rpm
       486609 fc1a2b813257322095e6303dc4c27799

 <Turbolinux 7 Workstation>

   Source Packages
   Size : MD5

   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Workstation/7/updates/SRPMS/proftpd-1.2.8-3.src.rpm
       799310 a3d08e2e400f57b66fd7c2022abd1d09

   Binary Packages
   Size : MD5

   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Workstation/7/updates/RPMS/proftpd-1.2.8-3.i586.rpm
       486725 67f5f2f278a25548fd5424d5c481e151

 <Turbolinux Server 6.5>

   Source Packages
   Size : MD5

   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/6.5/updates/SRPMS/proftpd-1.2.8-3.src.rpm
       799310 28b82c94e03161660db0a061e272b3cd

   Binary Packages
   Size : MD5

   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/6.5/updates/RPMS/proftpd-1.2.8-3.i386.rpm
       597007 830ce6d43eefabe6f52333fd34d52a98


 Notice :
    After performing the update, it is necessary to restart the proftpd daemon.
    To do this, run the following command as user root.
 ---------------------------------------------
 # /etc/init.d/proftpd restart
 or
 # /etc/rc.d/init.d/proftpd restart
 ---------------------------------------------


 References :

 ProFTPD org
   [News Flashes]
   http://www.proftpd.org/index.html

 CVE
   [CAN-2003-0831]
   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0831


 --------------------------------------------------------------------------
 Revision History
    30 Sep 2003 Initial release
 --------------------------------------------------------------------------


 * You may need to update the turbopkg tool before applying the update.
Please refer to the following URL for detailed information.

  http://www.turbolinux.com/download/zabom.html
  http://www.turbolinux.com/download/zabomupdate.html

Package Update Path
http://www.turbolinux.com/update

============================================================
 * To obtain the public key

Here is the public key

 http://www.turbolinux.com/security/

 * To unsubscribe from the list

If you ever want to remove yourself from this mailing list,
  you can send a message to <server-users-e-ctl@turbolinux.co.jp> with
the word `unsubscribe' in the body (don't include the quotes).

unsubscribe

 * To change your email address

If you ever want to chage email address in this mailing list,
  you can send a message to <server-users-e-ctl@turbolinux.co.jp> with
the following command in the message body:

  chaddr 'old address' 'new address'

If you have any questions or problems, please contact
<supp_info@turbolinux.co.jp>

Thank you!

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (GNU/Linux)

iD8DBQE/eUpeK0LzjOqIJMwRAgHMAKC1xePRCUT7zjP0zzrz+kh2QUfU1wCgkkFn
6W/tCuVbAJHn3Dm34MAe8UA=
=CZXF
-----END PGP SIGNATURE-----



_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2020, SecurityGlobal.net LLC