Date: Fri, 5 Aug 2005 18:49:46 +0200
From: Trustix Security Advisor <tsl@trustix.org.>
To: [email protected]Subject: TSLSA-2005-0040 - multi
Message-ID: <20050805164946.GA29398@tsunami.trustix.net.>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.4.2.1i
X-Virus-Scanned: antivirus-gw at tyumen.ru
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- --------------------------------------------------------------------------
Trustix Secure Linux Security Advisory #2005-0040
Package names: bzip2, perl-compress-zlib, proftpd
Summary: Multiple vulnerabilities
Date: 2005-08-05
Affected versions: Trustix Secure Linux 2.2
Trustix Secure Linux 3.0
Trustix Operating System - Enterprise Server 2
- --------------------------------------------------------------------------
Package description:
bzip2
Bzip2 is a freely available, patent-free, high quality data compressor.
Bzip2 compresses files to within 10 to 15 percent of the capabilities
of the best techniques available. However, bzip2 has the added benefit
of being approximately two times faster at compression and six times
faster at decompression than those techniques. Bzip2 is not the
fastest compression utility, but it does strike a balance between speed
and compression capability.
perl-compress-zlib
Compress-Zlib module from CPAN for perl
proftpd
ProFTPd is an enhanced FTP server with a focus toward simplicity,
security, and ease of configuration. It features a very Apache-like
configuration syntax, and a highly customizable server infrastructure,
including support for multiple 'virtual' FTP servers, anonymous FTP, and
permission-based directory visibility.
Problem description:
bzip2
- SECURITY Fix: Command injection vulnerability in the "bzgrep"
- bzgrep did not handle shell metacharacters like '|' and '&' properly
when they occurred in input file names. This could be exploited to
execute arbitrary commands with user privileges if bzgrep was run in
an untrusted directory with specially crafted file names.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CAN-2005-0758 to this issue.
perl-compress-zlib
- New upstream.
- SECURITY Fix: Previous version of Compress::Zlib contains a local
vulnerable version of zlib, which may lead to a buffer overflow.
(CAN-2005-1849).
proftpd
- SECURITY Fix: Format string vulnerabilities
- Two vulnerabilities have been reported in ProFTPD, which can be
exploited by malicious users to disclose certain sensitive
information, cause a DoS (Denial of Service), or potentially
compromise a vulnerable system.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CAN-2005-2390 to this issue.
Action:
We recommend that all systems with this package installed be upgraded.
Please note that if you do not need the functionality provided by this
package, you may want to remove it from your system.
Location:
All Trustix Secure Linux updates are available from
<URI:http://http.trustix.org/pub/trustix/updates/>;
<URI:ftp://ftp.trustix.org/pub/trustix/updates/>;
About Trustix Secure Linux:
Trustix Secure Linux is a small Linux distribution for servers. With focus
on security and stability, the system is painlessly kept safe and up to
date from day one using swup, the automated software updater.
Automatic updates:
Users of the SWUP tool can enjoy having updates automatically
installed using 'swup --upgrade'.
Questions?
Check out our mailing lists:
<URI:http://www.trustix.org/support/>;
Verification:
This advisory along with all Trustix packages are signed with the
TSL sign key.
This key is available from:
<URI:http://www.trustix.org/TSL-SIGN-KEY>;
The advisory itself is available from the errata pages at
<URI:http://www.trustix.org/errata/trustix-2.2/>; and
<URI:http://www.trustix.org/errata/trustix-3.0/>;
or directly at
<URI:http://www.trustix.org/errata/2005/0040/>;
MD5sums of the packages:
- --------------------------------------------------------------------------
c57a14ddc70dc381eea83b48d2698f22 3.0/rpms/bzip2-1.0.3-4tr.i586.rpm
3ad903577196558e5ce8efd602752257 3.0/rpms/bzip2-devel-1.0.3-4tr.i586.rpm
6bf458dd6edad3086a0c122e80f179cd 3.0/rpms/bzip2-libs-1.0.3-4tr.i586.rpm
fce91bc96bb5716a8518ec9c32e9d406 3.0/rpms/perl-compress-zlib-1.35-1tr.i586.rpm
b8a15769fa994e12a9416180fc01c495 3.0/rpms/proftpd-1.2.10-9tr.i586.rpm
114904521848d54ea07c8225d05c4e2e 2.2/rpms/bzip2-1.0.3-3tr.i586.rpm
21410bd75ce00fe486080777c0ba95f8 2.2/rpms/bzip2-devel-1.0.3-3tr.i586.rpm
bb79cd2198cc9a323639ff6188cd5fd9 2.2/rpms/bzip2-libs-1.0.3-3tr.i586.rpm
5a9be0817c3fb7aea5a74e62051edb74 2.2/rpms/perl-compress-zlib-1.35-1tr.i586.rpm
1b12b65524f9c4caa88523c81388853a 2.2/rpms/proftpd-1.2.10-9tr.i586.rpm
- --------------------------------------------------------------------------
Trustix Security Team
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)
iD8DBQFC85ahi8CEzsK9IksRArGxAKCpE2L7xpuqtydUUziV+uceT3YtKQCff/GD
+NtJ9EdUZADkzxlQfjMx0dU=
=0aeZ
-----END PGP SIGNATURE-----
