[Full-disclosure] [ MDVSA-2011:049 ] vsftpd

[security@xxxxxxxxxxxx]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2011:049
 http://www.mandriva.com/security/
 _______________________________________________________________________

 Package : vsftpd
 Date    : March 21, 2011
 Affected: 2009.0, 2010.0, 2010.1
 _______________________________________________________________________

 Problem Description:

 A vulnerability was discovered and corrected in vsftpd:
 
 The vsf_filename_passes_filter function in ls.c in vsftpd before 2.3.3
 allows remote authenticated users to cause a denial of service (CPU
 consumption and process slot exhaustion) via crafted glob expressions
 in STAT commands in multiple FTP sessions, a different vulnerability
 than CVE-2010-2632 (CVE-2011-0762).
 
 Packages for 2009.0 are provided as of the Extended Maintenance
 Program. Please visit this link to learn more:
 http://store.mandriva.com/product_info.php?cPath=149&products_id=490
 
 The updated packages have been patched to correct this issue.
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0762
 _______________________________________________________________________

 Updated Packages:

 Mandriva Linux 2009.0:
 af75c955fe2f0066443dd066c92e5934  
2009.0/i586/vsftpd-2.0.7-1.1mdv2009.0.i586.rpm 
 6797692c31d8510670e6ca9549b788f5  
2009.0/SRPMS/vsftpd-2.0.7-1.1mdv2009.0.src.rpm

 Mandriva Linux 2009.0/X86_64:
 c06224a723b0962125971c3a0b78f60f  
2009.0/x86_64/vsftpd-2.0.7-1.1mdv2009.0.x86_64.rpm 
 6797692c31d8510670e6ca9549b788f5  
2009.0/SRPMS/vsftpd-2.0.7-1.1mdv2009.0.src.rpm

 Mandriva Linux 2010.0:
 b28e1d800220a07367d27731ec59b6aa  
2010.0/i586/vsftpd-2.1.2-2.1mdv2010.0.i586.rpm 
 49fe47a2d746a315d9d48dbf6f81ac28  
2010.0/SRPMS/vsftpd-2.1.2-2.1mdv2010.0.src.rpm

 Mandriva Linux 2010.0/X86_64:
 37e329f1af12df81afd238576ded9dd6  
2010.0/x86_64/vsftpd-2.1.2-2.1mdv2010.0.x86_64.rpm 
 49fe47a2d746a315d9d48dbf6f81ac28  
2010.0/SRPMS/vsftpd-2.1.2-2.1mdv2010.0.src.rpm

 Mandriva Linux 2010.1:
 7a0693ee7b212c39a16866120f6da209  
2010.1/i586/vsftpd-2.2.2-4.1mdv2010.2.i586.rpm 
 94d699ea3f2def51b14873e5563afa48  
2010.1/SRPMS/vsftpd-2.2.2-4.1mdv2010.2.src.rpm

 Mandriva Linux 2010.1/X86_64:
 18bbb78b80cb91e5a3f4d4db4d661693  
2010.1/x86_64/vsftpd-2.2.2-4.1mdv2010.2.x86_64.rpm 
 94d699ea3f2def51b14873e5563afa48  
2010.1/SRPMS/vsftpd-2.2.2-4.1mdv2010.2.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFNhvvKmqjQ0CJFipgRAvT3AKCWRE++rQZ0gI2WDHboRDtHBsIYQwCfXNJu
K6Rmg6c7ET4kgWyH6lPS5YA=
=GdVc
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/