Fedora 10 ProFTPD 1.3.1-8 Critical: CSRF Command Execution Fix

ProFTPD is an enhanced FTP server with a focus toward simplicity, security,

and ease of configuration. It features a very Apache-like configuration

syntax, and a highly customizable server infrastructure, including support for

multiple 'virtual' FTP servers, anonymous FTP, and permission-based directory

visibility.

This package defaults to the standalone behaviour of ProFTPD, but all the

needed scripts to have it run by xinetd instead are included.

This update fixes a security issue where an attacker could conduct cross-site

request forgery (CSRF) attacks and execute arbitrary FTP commands. It also fixes

some SSL shutdown issues seen with certain clients.

* Fri Jan 2 2009 Matthias Saou 1.3.1-8

- Update default configuration to have a lit of available modules and more

example configuration for them.

- Include patches to fix TLS issues (#457280).

* Fri Jan 2 2009 Matthias Saou 1.3.1-7

- Add Debian patch to fix CSRF vulnerability (#464127, upstream #3115).

[ 1 ] Bug #464127 - CVE-2008-4242 proftpd CSRF attack

https://bugzilla.redhat.com/show_bug.cgi?id=464127

su -c 'yum update proftpd' at the command line.

For more information, refer to "Managing Software with yum",

available at .

All packages are signed with the Fedora Project GPG key. More details on the

GPG keys used by the Fedora Project can be found at

https://fedoraproject.org/security/

Fedora-package-announce mailing list

Fedora-package-announce@redhat.com

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/