| Description: | Summary:
The remote host is missing an update to proftpd
announced via advisory FEDORA-2009-13250.
Note: This VT has been deprecated and is therefore no longer functional.
Vulnerability Insight:
For details, please visit the referenced advisories.
ChangeLog:
* Thu Dec 10 2009 Paul Howarth 1.3.2c-1
- Update to 1.3.2c, addressing the following issues:
- SSL/TLS renegotiation vulnerability (CVE-2009-3555, bug 3324)
- Failed database transaction can cause mod_quotatab to loop (bug 3228)
- Segfault in mod_wrap (bug 3332)
- sections can have problems (bug 3337)
- mod_wrap2 segfaults when a valid user retries the USER command (bug 3341)
- mod_auth_file handles 'getgroups' request incorrectly (bug 3347)
- Segfault caused by scrubbing zero-length portion of memory (bug 3350)
- Drop upstreamed segfault patch
* Thu Dec 10 2009 Paul Howarth 1.3.2b-3
- Add patch for upstream bug 3350 - segfault on auth failures
* Wed Dec 9 2009 Paul Howarth 1.3.2b-2
- Reduce the mod_facts patch to the single commit addressing the issue with
directory names with glob characters (#521634), avoiding introducing a
further problem with (#544002)
Solution:
Apply the appropriate updates.
This update can be installed with the yum update program. Use
su -c 'yum update proftpd' at the command line.
CVSS Score:
5.8
CVSS Vector:
AV:N/AC:M/Au:N/C:N/I:P/A:P
|
