Debian: New wu-ftpd packages fix denial of service
Summary
- --------------------------------------------------------------------------Debian Security Advisory DSA 705-1 security@debian.org http://www.debian.org/security/ Martin Schulze April 4th, 2005 http://www.debian.org/security/faq - --------------------------------------------------------------------------Package : wu-ftpd Vulnerability : missing input sanitising Problem-Type : remote Debian-specific: no CVE IDs : CAN-2005-0256 CAN-2003-0854 Several denial of service conditions have been discovered in wu-ftpd, the popular FTP daemon. The Common Vulnerabilities and Exposures project identifies the following problems: CAN-2005-0256 Adam Zabrocki discovered a denial of service condition in wu-ftpd that could be exploited by a remote user and cause the server to slow down the server by resource exhaustion. CAN-2003-0854 Georgi Guninski discovered that /bin/ls may be called from within wu-ftpd in a way that will result in large memory consumption and hence slow down the server. For the stable distribution (woody) these problems have been fixed in version 2.6.2-3woody5. For the unstable distribution (sid) these problems have been fixed in version 2.6.2-19. We recommend that you upgrade your wu-ftpd package. Upgrade Instructions - --------------------wget url will fetch the file for you dpkg -i file.deb will install the referenced file. If you are using the apt-get package manager, use the line for sources.list as given below: apt-get update will update the internal database apt-get upgrade will install corrected packages You may use an automated update by adding the resources from the footer to the proper configuration. Debian GNU/Linux 3.0 alias woody - -------------------------------- Source archives: Size/MD5 checksum: 607 78463b3882e0d32102344bb0580e0d98 Size/MD5 checksum: 101661 967b719c02892c867ad0d6456a5dd47a Size/MD5 checksum: 354784 b3c271f02aadf663b8811d1bff9da3f6 Architecture independent components: Size/MD5 checksum: 3484 cc6ee1aeb156077af311870f095840ab Alpha architecture: Size/MD5 checksum: 292630 c164f9f2d0ae5d70587ca49ddbe543b4 ARM architecture: Size/MD5 checksum: 265840 c86cdbc78969f755dce0facce4a1f882 Intel IA-32 architecture: Size/MD5 checksum: 255216 504af14aec48191405c08a56845d330b Intel IA-64 architecture: Size/MD5 checksum: 321932 ced4192d937ccedfa5a7ab2e9e77c378 HP Precision architecture: Size/MD5 checksum: 276624 4a1b5b6115ed1d93206c9787e8d37038 Motorola 680x0 architecture: Size/MD5 checksum: 249810 e873e950d3b234a7854ee0e4810783f5 Big endian MIPS architecture: Size/MD5 checksum: 273426 364c07d6a21f8aab43b3841ce98df8c6 Little endian MIPS architecture: Size/MD5 checksum: 273568 4e51f44342035b6ecafc624b1a6c06f3 PowerPC architecture: Size/MD5 checksum: 268816 4072fbbb73bd8013b9a191f3aa7bd778 IBM S/390 architecture: Size/MD5 checksum: 263638 d86fc84ab2974a80fd7407d826d8b003 Sun Sparc architecture: Size/MD5 checksum: 270784 1110401bccc9035cc1b30eb8146aee18 These files will probably be moved into the stable distribution on its next update. - ---------------------------------------------------------------------------------For apt-get: deb http://security.debian.org/ stable/updates main For dpkg-ftp: dists/stable/updates/main Mailing list: debian-security-announce@lists.debian.org