Ubuntu 11.10: 1288-1 Moderate: Vsftpd Denial of Service Problem

ubuntu

December 7, 2011

Vsftpd or other applications could be made to crash if vsftpd received specially crafted network traffic.

Summary

Vsftpd or other applications could be made to crash if vsftpd received

specially crafted network traffic.

Software Description:

- vsftpd: FTP server written for security

Details:

It was discovered that the 2.6.35 and earlier Linux kernel does not

properly handle a high rate of creation and cleanup of network namespaces,

which makes it easier for remote attackers to cause a denial of service

(memory consumption) in applications that require a separate namespace per

connection, like vsftpd. This update adjusts vsftpd to only use network

namespaces on kernels that are known to be not affected.

Topics Covered

security advisory denial of service ubuntu vsftpd network issue

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 11.10:
  vsftpd                          2.3.2-3ubuntu5.1

Ubuntu 11.04:
  vsftpd                          2.3.2-3ubuntu4.1

Ubuntu 10.10:
  vsftpd                          2.3.0~pre2-4ubuntu2.3

Ubuntu 10.04 LTS:
  vsftpd                          2.2.2-3ubuntu6.3

In general, a standard system update will make all the necessary changes.