proftpd-1.3.3g-2.el5 security update
|Release:||Fedora EPEL 5|
|Date Submitted:||2013-01-18 17:46:18|
|Date Released:||2013-01-22 02:42:56|
Jann Horn reported that there is a possible race condition in the handling of the MKD/XMKD FTP commands, when the UserOwner directive is involved, and the attacker is on the same physical machine as a running proftpd. This race applies to mod_sftp and the handling of the MKDIR SFTP request as well.
Note that using the DefaultRoot directive to restrict sessions mitigates this attack, since the symlinks created by the local attacker will point outside of the chroot(2) area within the FTP session, and thus the ownership change will fail. The default configuration in EPEL applies the DefaultRoot directive to all users except "adm".
The upstream reference for this issue is: http://bugs.proftpd.org/show_bug.cgi?id=3841
This update includes a backport to 1.3.3g of upstream's backport to proftpd 1.3.4 of the fix for this issue.Bugs Fixed892715 - CVE-2012-6095: proftpd: Symlink race condition when applying UserOwner to a newly (ProFTPD) created directorybodhi - 2013-01-18 17:46:32This update has been submitted for testing by pghmcfc.
bodhi - 2013-01-22 01:39:09This update is currently being pushed to the Fedora EPEL 5 testing updates repository.
bodhi - 2013-01-22 03:34:46This update has been pushed to testing
bodhi - 2013-02-05 10:05:38This update has reached 14 days in testing and can be pushed to stable now if the maintainer wishes
bodhi - 2013-02-05 10:43:16This update has been submitted for stable by pghmcfc.
bodhi - 2013-02-05 19:33:52This update is currently being pushed to the Fedora EPEL 5 stable updates repository.
bodhi - 2013-02-05 21:22:39This update has been pushed to stable