[ GLSA 200711-01 ] gFTP: Multiple vulnerabilities

[GLSA]

Gentoo Linux Security Advisory

Title: gFTP: Multiple vulnerabilities (GLSA 200711-01)
Severity: normal
Exploitable: remote
Date: November 01, 2007
Bug(s): #188252
ID: 200711-01

Synopsis

Two buffer overflow vulnerabilities have been discovered in fsplib code used in gFTP.

Background

gFTP is an FTP client for the GNOME desktop environment.

Affected Packages

Package: net-ftp/gftp
Vulnerable: < 2.0.18-r6
Unaffected: >= 2.0.18-r6
Architectures: All supported architectures


Description

Kalle Olavi Niemitalo discovered two boundary errors in fsplib code included in gFTP when processing overly long directory or file names.

Impact

A remote attacker could trigger these vulnerabilities by enticing a user to download a file with a specially crafted directory or file name, possibly resulting in the execution of arbitrary code (CVE-2007-3962) or a Denial of Service (CVE-2007-3961).

Workaround

There is no known workaround at this time.

Resolution

All gFTP users should upgrade to the latest version: