ian! Bodhisattva
Joined: 25 Feb 2003 Posts: 3829 Location: Essen, Germany
|
Posted: Fri Dec 19, 2003 9:52 pm Post subject: [gentoo-announce] GLSA: lftp (200312-07) |
|
|
--------------------------------------------------------------------------
GENTOO LINUX SECURITY ANNOUNCEMENT 200312-07
--------------------------------------------------------------------------
GLSA: 200312-07
Package: net-ftp/lftp
Summary: Two buffer overflow problems found in lftp
Severity: minimal
Gentoo bug: 35866
Date: 2003-12-16
CVE: CAN-2003-0963
Exploit: remote
Affected: <=2.6.9
Fixed: >=2.6.10
DESCRIPTION:
Two buffer overflow problems have been found in lftp, a multithreaded
command-line based FTP client. A specially created directory on a web
server could be used to execute arbitrary code on the connecting machine.
The user's machine has to connect to a malicious web server using HTTP or
HTTPS, then issue an "ls" or "rels" command.
Please see
<http://www.securityfocus.com/archive/1/347587/2003-12-13/2003-12-19/0>
for more details on this problem.
SOLUTION:
All machines which have net-ftp/lftp installed should be updated to use
version 2.6.10 or higher using these commands:
emerge sync
emerge -pv '>=net-ftp/lftp-2.6.10'
emerge '>=net-ftp/lftp-2.6.10'
emerge clean
// end _________________ "To have a successful open source project, you need to be at least somewhat successful at getting along with people." -- Daniel Robbins |
|