-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 --------------------------------------------------------------------------
   Turbolinux Security Advisory TLSA-2005-39
   http://www.turbolinux.co.jp/security/
                                             security-team@turbolinux.co.jp
 --------------------------------------------------------------------------

 Original released date: 31 Mar 2005
 Last revised: 31 Mar 2005

 Package: gftp

 Summary: Sanitization bug

 More information:
    gFTP is a multi-threaded FTP client for the X Window System.

    Directory traversal vulnerability in gftp for GTK+ allows remote malicious
    FTP servers to read arbitrary files via .. (dot dot) sequences in
    filenames returned from a LIST command.

 Impact:
    This vulerability could allow attackers to overwrite arbitrary files.

 Affected Products:
    - Turbolinux 8 Server
    - Turbolinux 8 Workstation
    - Turbolinux 7 Server
    - Turbolinux 7 Workstation

 Solution:
    Please use the turbopkg (zabom) tool to apply the update. 
 ---------------------------------------------
 # turbopkg
 or
 # zabom update gftp
 ---------------------------------------------


 <Turbolinux 8 Server>

   Source Packages
   Size: MD5

   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/8/updates/SRPMS/gftp-2.0.8-7.src.rpm
       821432 840c913b8188d20a70c89288358f600d

   Binary Packages
   Size: MD5

   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/8/updates/RPMS/gftp-2.0.8-7.i586.rpm
       400213 5d99c71cf844f94d5b7cdfd4c9c10f4a

 <Turbolinux 8 Workstation>

   Source Packages
   Size: MD5

   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/8/updates/SRPMS/gftp-2.0.8-7.src.rpm
       821432 8da84902cd466158bef247d86840c435

   Binary Packages
   Size: MD5

   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/8/updates/RPMS/gftp-2.0.8-7.i586.rpm
       400501 40488826215ed961e888547e1b15d576

 <Turbolinux 7 Server>

   Source Packages
   Size: MD5

   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/7/updates/SRPMS/gftp-2.0.8-7.src.rpm
       821432 b683b0f4421833d93409b720461d604c

   Binary Packages
   Size: MD5

   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/7/updates/RPMS/gftp-2.0.8-7.i586.rpm
       394832 0dc53fbc8525de64d4f7ca083f9564b4

 <Turbolinux 7 Workstation>

   Source Packages
   Size: MD5

   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/7/updates/SRPMS/gftp-2.0.8-7.src.rpm
       821432 c1de62362497c32a1c148d1ac775f8f1

   Binary Packages
   Size: MD5

   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/7/updates/RPMS/gftp-2.0.8-7.i586.rpm
       395269 c8169afedae3559d06a6f231b1a258a0


 References:

 CVE
   [CAN-2005-0372]
   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0372

 --------------------------------------------------------------------------
 Revision History
    31 Mar 2005 Initial release
 --------------------------------------------------------------------------

 Copyright(C) 2005 Turbolinux, Inc. All rights reserved. 

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.7 (GNU/Linux)

iD8DBQFCS6MwK0LzjOqIJMwRAtCXAKCo67G8achDX1+GyNjy2unz1yD7tACgpf5/
Eae7Ok3nrmZzuk1+Hke26NY=
=61jA
-----END PGP SIGNATURE-----