Date: Fri, 30 Apr 2004 16:17:50 +0200
From: Trustix Security Advisor <[email protected]>
To: [email protected]Subject: TSLSA-2004-0025 - multi
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- --------------------------------------------------------------------------
Trustix Secure Linux Security Advisory #2004-0025
Package name: libpng proftpd
Summary: Potential security holes
Date: 2004-04-30
Affected versions: Trustix Secure Linux 2.0
Trustix Secure Linux 2.1
Trustix Secure Enterprise Linux 2
- --------------------------------------------------------------------------
Package description:
libpng:
A library of functions for creating and manipulating PNG
(Portable Network Graphics) image format files.
proftpd:
An enhanced FTP server with a focus toward simplicity, security,
and ease of configuration. It features a very Apache-like configuration
syntax, and a highly customizable server infrastructure, including
support for multiple 'virtual' FTP servers, anonymous FTP, and
permission-based directory visibility.
Problem description:
libpng:
Steve Grubb discovered that libpng would access memory that is out of
bounds when creating an error message. The impact of this bug is not
clear, but it could lead to a core dump in a program using libpng, or
could result in a DoS (Denial of Service) condition in a daemon that
uses libpng to process PNG images.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CAN-2004-0421 to this issue.
proftpd:
A portability workaround was applied in version 1.2.9 of the FTP
server ProFTPD. As a side-effect, CIDR based (aaa.bbb.ccc.ddd/NN)
ACL entries in "Allow" and "Deny" directives act like a "AllowAll"
directive and so FTP clients are granted access to files and
directories although the server configuration explicitly deny this
access.
This issue only affects proftpd 1.2.9, which is shipped with Trustix
Secure Linux 2.1 and Trustix Secure Enterprise Linux 2. Trustix Secure
Linux 2.0 uses proftpd 1.2.8, and is NOT affected by this issue.
Action:
We recommend that all systems with this package installed be upgraded.
Please note that if you do not need the functionality provided by this
package, you may want to remove it from your system.
Location:
All Trustix Secure Linux updates are available from
<URI:http://http.trustix.org/pub/trustix/updates/>;
<URI:ftp://ftp.trustix.org/pub/trustix/updates/>;
About Trustix Secure Linux:
Trustix Secure Linux is a small Linux distribution for servers. With focus
on security and stability, the system is painlessly kept safe and up to
date from day one using swup, the automated software updater.
Automatic updates:
Users of the SWUP tool can enjoy having updates automatically
installed using 'swup --upgrade'.
Public testing:
Most updates for Trustix Secure Linux are made available for public
testing some time before release.
If you want to contribute by testing the various packages in the
testing tree, please feel free to share your findings on the
tsl-discuss mailinglist.
The testing tree is located at
<URI:http://tsldev.trustix.org/horizon/>;
You may also use swup for public testing of updates:
site {
class = 0
location = "http://tsldev.trustix.org/horizon/rdfs/latest.rdf"
regexp = ".*"
}
Questions?
Check out our mailing lists:
<URI:http://www.trustix.org/support/>;
Verification:
This advisory along with all Trustix packages are signed with the
TSL sign key.
This key is available from:
<URI:http://www.trustix.org/TSL-SIGN-KEY>;
The advisory itself is available from the errata pages at
<URI:http://www.trustix.org/errata/trustix-2.0/>; and
<URI:http://www.trustix.org/errata/trustix-2.1/>;
or directly at
<URI:http://www.trustix.org/errata/misc/2004/TSL-2004-0025-multi.asc.txt>;
MD5sums of the packages:
- --------------------------------------------------------------------------
62bd819bba0cff8a9507d8fa46b43d55 TSEL-2/libpng-1.2.5-9tr.i586.rpm
5bed4b3d9285c8b46b70bb062b9e8c25 TSEL-2/libpng-devel-1.2.5-9tr.i586.rpm
72c1f469310c9feeb1ab278d385578b0 TSEL-2/libpng-tools-1.2.5-9tr.i586.rpm
549de5b6837cf56088320ecc68655a0a TSEL-2/proftpd-1.2.9-7tr.i586.rpm
082cb022028baef72bd90dd6ccb9d5de 2.1/rpms/libpng-1.2.5-9tr.i586.rpm
d421874e6cd70ddb80f5fa2008ea3e8b 2.1/rpms/libpng-devel-1.2.5-9tr.i586.rpm
6576f73e5a336e1649e31f65481172d3 2.1/rpms/libpng-tools-1.2.5-9tr.i586.rpm
3ad72fe97c3cdd1ae3a3dc9d177719c9 2.1/rpms/proftpd-1.2.9-7tr.i586.rpm
24541a0458eaf894050b64bc02f2ab5f 2.0/rpms/libpng12-1.2.5-4tr.i586.rpm
61609475829abcf2a4246557fc1e2d30 2.0/rpms/libpng12-devel-1.2.5-4tr.i586.rpm
- --------------------------------------------------------------------------
Trustix Security Team
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (GNU/Linux)
iD8DBQFAkll+i8CEzsK9IksRAu68AKCUh9It0ZFcHcR+qv4KHG4OeWRLmQCgtqPl
P/OIsQdWeCnuQXN8k3FNm2w=
=YHUi
-----END PGP SIGNATURE-----
