--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2011-3011
2011-04-08 20:02:25
--------------------------------------------------------------------------------
Name : proftpd
Product : Fedora EPEL 4
Version : 1.3.3e
Release : 1.el4
URL :
http://www.proftpd.org/
Summary : Flexible, stable and highly-configurable FTP server
Description :
ProFTPD is an enhanced FTP server with a focus toward simplicity, security,
and ease of configuration. It features a very Apache-like configuration
syntax, and a highly customizable server infrastructure, including support for
multiple 'virtual' FTP servers, anonymous FTP, and permission-based directory
visibility.
This package defaults to the standalone behavior of ProFTPD, but all the
needed scripts to have it run by xinetd instead are included.
--------------------------------------------------------------------------------
Update Information:
This update, to the current upstream maintenance release, fixes a large number of bugs
(see NEWS for details), and also a couple of security issues:
* Plaintext command injection vulnerability in FTPS implementation (i.e. mod_tls). See
http://bugs.proftpd.org/show_bug.cgi?id=3624 for details.
* CVE-2011-1137 (badly formed SSH messages cause DoS). See
http://bugs.proftpd.org/show_bug.cgi?id=3586 for details.
Other highlights include:
* Display messages work properly again.
* Performance improvements, especially during server startup/restarts.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #681718 - CVE-2011-1137 proftpd: integer overflow in mod_sftp
https://bugzilla.redhat.com/show_bug.cgi?id=681718
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update proftpd' at the command line.
For more information, refer to "Managing Software with yum",
available at
http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------