Debians sikkerhedsbulletin

DSA-281-1 moxftp -- bufferoverløb

Rapporteret den:

8. apr 2003

Berørte pakker:

moxftp

Sårbar:

Referencer i sikkerhedsdatabaser:

I Bugtraq-databasen (hos SecurityFocus): BugTraq-id 6921.
I Mitres CVE-ordbog: CVE-2003-0203.

Yderligere oplysninger:

Knud Erik Højgaard har opdaget en sårbarhed i moxftp (henholdsvis xftp), en Athena X-grænseflade til ftp. Utilstrækkelig grænsekontrol kunne føre til udførelse af vilkårlig kode, tilgængelig på en ondsindet ftp-server. Erik Tews har rettet dette.

I den stabile distribution (woody) er dette problem rettet i version 2.2-18.1.

I den gamle stabile distribution (potato) er dette problem rettet i version 2.2-13.1.

I den ustabile distribution (sid) er dette problem rettet i version 2.2-18.20.

Vi anbefaler at du opgraderer din xftp-pakke.

Rettet i:

Debian GNU/Linux 2.2 (potato)

Kildekode:: http://security.debian.org/pool/updates/main/m/moxftp/moxftp_2.2-13.1.dsc; http://security.debian.org/pool/updates/main/m/moxftp/moxftp_2.2-13.1.diff.gz; http://security.debian.org/pool/updates/main/m/moxftp/moxftp_2.2.orig.tar.gz
Alpha:: http://security.debian.org/pool/updates/main/m/moxftp/xftp_2.2-13.1_alpha.deb
ARM:: http://security.debian.org/pool/updates/main/m/moxftp/xftp_2.2-13.1_arm.deb
Intel IA-32:: http://security.debian.org/pool/updates/main/m/moxftp/xftp_2.2-13.1_i386.deb
Motorola 680x0:: http://security.debian.org/pool/updates/main/m/moxftp/xftp_2.2-13.1_m68k.deb
PowerPC:: http://security.debian.org/pool/updates/main/m/moxftp/xftp_2.2-13.1_powerpc.deb
Sun Sparc:: http://security.debian.org/pool/updates/main/m/moxftp/xftp_2.2-13.1_sparc.deb

Debian GNU/Linux 3.0 (woody)

Kildekode:: http://security.debian.org/pool/updates/main/m/moxftp/moxftp_2.2-18.1.dsc; http://security.debian.org/pool/updates/main/m/moxftp/moxftp_2.2-18.1.diff.gz; http://security.debian.org/pool/updates/main/m/moxftp/moxftp_2.2.orig.tar.gz
Alpha:: http://security.debian.org/pool/updates/main/m/moxftp/xftp_2.2-18.1_alpha.deb
ARM:: http://security.debian.org/pool/updates/main/m/moxftp/xftp_2.2-18.1_arm.deb
Intel IA-32:: http://security.debian.org/pool/updates/main/m/moxftp/xftp_2.2-18.1_i386.deb
Intel IA-64:: http://security.debian.org/pool/updates/main/m/moxftp/xftp_2.2-18.1_ia64.deb
HPPA:: http://security.debian.org/pool/updates/main/m/moxftp/xftp_2.2-18.1_hppa.deb
Motorola 680x0:: http://security.debian.org/pool/updates/main/m/moxftp/xftp_2.2-18.1_m68k.deb
Big endian MIPS:: http://security.debian.org/pool/updates/main/m/moxftp/xftp_2.2-18.1_mips.deb
Little endian MIPS:: http://security.debian.org/pool/updates/main/m/moxftp/xftp_2.2-18.1_mipsel.deb
PowerPC:: http://security.debian.org/pool/updates/main/m/moxftp/xftp_2.2-18.1_powerpc.deb
IBM S/390:: http://security.debian.org/pool/updates/main/m/moxftp/xftp_2.2-18.1_s390.deb
Sun Sparc:: http://security.debian.org/pool/updates/main/m/moxftp/xftp_2.2-18.1_sparc.deb

MD5-kontrolsummer for de listede filer findes i den originale sikkerhedsbulletin.