--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2015-6401
2015-04-18 05:44:50
--------------------------------------------------------------------------------

Name        : proftpd
Product     : Fedora 20
Version     : 1.3.4e
Release     : 3.fc20
URL         : http://www.proftpd.org/
Summary     : Flexible, stable and highly-configurable FTP server
Description :
ProFTPD is an enhanced FTP server with a focus toward simplicity, security,
and ease of configuration. It features a very Apache-like configuration
syntax, and a highly customizable server infrastructure, including support for
multiple 'virtual' FTP servers, anonymous FTP, and permission-based directory
visibility.

This package defaults to the standalone behavior of ProFTPD, but all the
needed scripts to have it run by xinetd instead are included.

--------------------------------------------------------------------------------
Update Information:

Vadim Melihow reported a critical issue with proftpd installations that use the mod_copy module's SITE CPFR/SITE CPTO commands; mod_copy allows these commands to be used by *unauthenticated clients*

Upstream report:
http://bugs.proftpd.org/show_bug.cgi?id=4169

This update contains a backported fix for this issue.

Note that mod_copy is not loaded/enabled by default in the Fedora package.
--------------------------------------------------------------------------------
ChangeLog:

* Thu Apr 23 2015 Paul Howarth  - 1.3.4e-3
- Fix failure to load mod_copy by removing references to function that has not
  been backported
* Wed Apr 15 2015 Paul Howarth  - 1.3.4e-2
- Unauthenticated copying of files via SITE CPFR/CPTO was allowed by mod_copy
  (CVE-2015-3306, http://bugs.proftpd.org/show_bug.cgi?id=4169)
- Fix wrong size in memset in mod_sftp_pam causing compiler warning
* Mon Feb 16 2015 Paul Howarth  - 1.3.4e-1
- Update to 1.3.4e
  - Fixed numerous upstream-reported bugs:
    - Spurious log messages at session close (bug 3945)
    - LogFormat %f variable not resolved properly for SFTP renames (bug 3947)
    - mod_delay allows too-large values, leading to client hang on
      authentication (bug 3858)
    - Null pointer dereference for mod_ldap logins when LDAPDefaultAuthScheme
      not configured (bug 3951)
    - scp downloads result in segfault (bug 3954)
    - ProFTPD configuration with thousands of / sections
      leads to slow logins (bug 3957)
    - mod_sftp does not honor / sections when symlinks are
      involved (bug 3959)
    - Directory creation does not honor single-parameter Umask setting
      (bug 3958)
    - Directory creation fails (chmod(2) EPERM) when root privs are used in
      some cases (bug 3962)
    - Authentication error on Cygwin due to bad code (bug 3972)
    - mod_sftp can be forced to allocate too much memory for
      keyboard-interactive authentication (bug 3973, CVE-2013-4359)
    - PathDenyFilter directive does not work as expected for SFTP sessions
      (bug 3974)
    - Improve permission setting when creating directories (bug 3963)
    - Null pointer dereference in mod_exec with ExecOption useStdin (bug 3981)
    - Support filesystems that do not support chmod(2)/chown(2), e.g. FAT/ExFAT
      (bug 3986)
    - SSL session caching modules use incorrect OpenSSL cache mode flags,
      breaking session caching (bug 3991)
    - ProFTPD should not use fd 2 (stderr) for files (bug 3970)
    - RSA signature issue when connecting using PuTTY/WinSCP (bug 3992)
    - mod_sftp fails key exchange for 8192-bit DH group (bug 4001)
    - IgnoreSCPUploadPerms SFTPOption not honored properly for SCP directory
      upload (bug 4004)
    - RADIUS "service-type" attribute encoded with wrong length on 64-bit
      system (bug 4006)
    - SCP upload of shorter file does not completely overwrite existing file of
      same name (bug 4013)
    - "Directory not empty" error when creating directory is misleading
      (bug 4022)
    - Restarting proftpd with mod_sftp fails due to permissions on SFTPHostKey
      file (bug 4032)
    - SSH publickey authentication fails with "MaxLoginAttempts 1" (bug 4034)
    - ALLO command failed because of bad size check (bug 4046)
    - Race condition in mod_ban can lead to segfault of all new connections
      (bug 4048)
    - MIC command between RNFR and RNTO should not be rejected (bug 4042)
    - mod_facl prevents a normal SIGHUP reload (bug 4044)
- Drop patches for issues resolved in new upstream release
- Anonymous upload directory specification needs to be slightly different if
  mod_vroot is in use (#1045922)
  https://sourceforge.net/p/proftp/mailman/message/31728570/
- Backport some changes from upstream's 1.3.5 release to get the API tests to
  build
- Use %license where possible
* Fri Dec 20 2013 Paul Howarth  1.3.4d-5
- Fix support for 8192-bit DH parameters (#1044586)
- Add 3072-bit and 7680-bit DH parameters (upstream bug 4002)
--------------------------------------------------------------------------------
References:

  [ 1 ] Bug #1212386 - CVE-2015-3306 proftpd: unauthenticated copying of files via SITE CPFR/CPTO allowed by mod_copy
        https://bugzilla.redhat.com/show_bug.cgi?id=1212386
--------------------------------------------------------------------------------

This update can be installed with the "yum" update program.  Use
su -c 'yum update proftpd' at the command line.
For more information, refer to "Managing Software with yum",
available at .

All packages are signed with the Fedora Project GPG key.  More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/security/
--------------------------------------------------------------------------------
_______________________________________________
package-announce mailing list
package-announce@lists.fedoraproject.org
https://lists.fedoraproject.org/admin/lists/package-announce.lists.fedoraproject.org/