DESCRIPTION
The anonftp package contains a chroot environment used by some FTP
servers (e. g. wu-ftpd) when serving anonymous FTP sessions. Among
the utilities provided, is the "ls" program, used to list information
about files and directories.
This update is a follow-up to the CLSA-2003:768 announcement[1],
which fixed a memory starvation vulnerability in the ls program (from
the fileutils package). Since the anonftp package contains a copy of
the ls program, it is also being updated. Below is a copy of our
previous text describing the vulnerability:
Georgi Guninski discovered[2] a memory starvation denial of service
vulnerability in the ls program. It is possible to make ls allocate a
huge amount of memory by calling it with the parameters "-w X -C"
(where X is an arbitrary large number). The Common Vulnerabilities
and Exposures project (cve.mitre.org) has assigned the name
CAN-2003-0854[3] to this issue.
This vulnerability is remotely exploitable in scenarios where remote
applications allow users to call ls without filtering the supplied
parameters. An example of such a scenario is the use of the wu-ftpd
FTP server.
Additionally, this update fixes an integer overflow in ls which seems
to be non-exploitable. The overflow occurs in the usage of the "-w"
parameter under the same circumstances of the aforementioned memory
starvation vulnerability. The Common Vulnerabilities and Exposures
project (cve.mitre.org) has assigned the name CAN-2003-0853[4] to
this issue.
SOLUTION
All users of the anonftp package should upgrade.
ADDITIONAL INSTRUCTIONS
The apt tool can be used to perform RPM packages upgrades:
- run: apt-get update
- after that, execute: apt-get upgrade
Detailed instructions reagarding the use of apt and upgrade examples
can be found at http://distro.conectiva.com.br/atualizacoes/#apt?idioma=en
- ------------------------------------------------------------------------
-
All packages are signed with Conectiva's GPG key. The key and instructions
on how to import it can be found at
http://distro.conectiva.com.br/seguranca/chave/?idioma=en
Instructions on how to check the signatures of the RPM packages can be
found at http://distro.conectiva.com.br/seguranca/politica/?idioma=en
- ------------------------------------------------------------------------
-
All our advisories and generic update instructions can be viewed at
http://distro.conectiva.com.br/atualizacoes/?idioma=en
- ------------------------------------------------------------------------
-
Copyright (c) 2003 Conectiva Inc.
http://www.conectiva.com
Hash: SHA1
- ------------------------------------------------------------------------
--
CONECTIVA LINUX SECURITY ANNOUNCEMENT
- ------------------------------------------------------------------------
--
PACKAGE : anonftp
SUMMARY : Remote denial of service vulnerability
DATE : 2003-10-24 14:49:00
ID : CLA-2003:771
RELEVANT
RELEASES : 7.0, 8, 9
- ------------------------------------------------------------------------
-
DESCRIPTION
The anonftp package contains a chroot environment used by some FTP
servers (e. g. wu-ftpd) when serving anonymous FTP sessions. Among
the utilities provided, is the "ls" program, used to list information
about files and directories.
This update is a follow-up to the CLSA-2003:768 announcement[1],
which fixed a memory starvation vulnerability in the ls program (from
the fileutils package). Since the anonftp package contains a copy of
the ls program, it is also being updated. Below is a copy of our
previous text describing the vulnerability:
Georgi Guninski discovered[2] a memory starvation denial of service
vulnerability in the ls program. It is possible to make ls allocate a
huge amount of memory by calling it with the parameters "-w X -C"
(where X is an arbitrary large number). The Common Vulnerabilities
and Exposures project (cve.mitre.org) has assigned the name
CAN-2003-0854[3] to this issue.
This vulnerability is remotely exploitable in scenarios where remote
applications allow users to call ls without filtering the supplied
parameters. An example of such a scenario is the use of the wu-ftpd
FTP server.
Additionally, this update fixes an integer overflow in ls which seems
to be non-exploitable. The overflow occurs in the usage of the "-w"
parameter under the same circumstances of the aforementioned memory
starvation vulnerability. The Common Vulnerabilities and Exposures
project (cve.mitre.org) has assigned the name CAN-2003-0853[4] to
this issue.
SOLUTION
All users of the anonftp package should upgrade.
REFERENCES
1.http://distro.conectiva.com.br/atualizacoes/index.php?id=a&anuncio=000
768&idioma=en
2.http://www.guninski.com/binls.html
3.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0854
4.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0853
UPDATED PACKAGES
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/anonftp-3.0-7U70_1cl.i386.r
pm
ftp://atualizacoes.conectiva.com.br/7.0/SRPMS/anonftp-3.0-7U70_1cl.src.r
pm
ftp://atualizacoes.conectiva.com.br/8/RPMS/anonftp-3.0-9U80_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/SRPMS/anonftp-3.0-9U80_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/anonftp-3.0-22686U90_2cl.i386
.rpm
ftp://atualizacoes.conectiva.com.br/9/SRPMS/anonftp-3.0-22686U90_2cl.src
.rpm
ADDITIONAL INSTRUCTIONS
The apt tool can be used to perform RPM packages upgrades:
- run: apt-get update
- after that, execute: apt-get upgrade
Detailed instructions reagarding the use of apt and upgrade examples
can be found at http://distro.conectiva.com.br/atualizacoes/#apt?idioma=en
- ------------------------------------------------------------------------
-
All packages are signed with Conectiva's GPG key. The key and instructions
on how to import it can be found at
http://distro.conectiva.com.br/seguranca/chave/?idioma=en
Instructions on how to check the signatures of the RPM packages can be
found at http://distro.conectiva.com.br/seguranca/politica/?idioma=en
- ------------------------------------------------------------------------
-
All our advisories and generic update instructions can be viewed at
http://distro.conectiva.com.br/atualizacoes/?idioma=en
- ------------------------------------------------------------------------
-
Copyright (c) 2003 Conectiva Inc.
http://www.conectiva.com
- ------------------------------------------------------------------------
-
subscribe: conectiva-updates-subscribe (at) papaleguas.conectiva.com (dot) br [email concealed]
unsubscribe: conectiva-updates-unsubscribe (at) papaleguas.conectiva.com (dot) br [email concealed]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org
iD8DBQE/mVoC42jd0JmAcZARAlS4AKDWB6D3ct6gIoAud/2kp8iLxa1zOwCdEO13
/Pq7zEZpidAqTkRrYhLdiHE=
=zS3P
-----END PGP SIGNATURE-----
[ reply ]