|
|
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- --------------------------------------------------------------------------
Trustix Secure Linux Security Advisory #2006-0066
Package names: openldap, proftpd
Summary: Multiple vulnerabilities
Date: 2006-11-28
Affected versions: Trustix Secure Linux 2.2
Trustix Secure Linux 3.0
Trustix Operating System - Enterprise Server 2
- --------------------------------------------------------------------------
Package description:
openldap
OpenLDAP is an open-source suite of LDAP (Lightweight Directory Access
Protocol) applications and development tools. LDAP is a set of
protocols for accessing directory services (usually phone book style
information, but other information is possible) over the Internet,
similar to the way DNS (Domain Name System) information is propagated
over the Internet. This package contains the slapd and slurpd servers,
migration scripts, and related files.
proftpd
ProFTPd is an enhanced FTP server with a focus toward simplicity,
security, and ease of configuration. It features a very Apache-like
configuration syntax, and a highly customizable server infrastructure,
including support for multiple 'virtual' FTP servers, anonymous FTP,
and permission-based directory visibility.
Problem description:
openldap < TSL 3.0 > < TSL 2.2 > < TSEL 2 >
- SECURITY Fix: Evgeny Legerov has reported a vulnerability in
OpenLDAP, caused due to an error when processing certain BIND
requests. This can be exploited to cause a crash by sending specially
crafted BIND requests to an OpenLDAP server.
The Common Vulnerabilities and Exposures project has assigned the
name CVE-2006-5779 to this issue.
proftpd < TSL 3.0 > < TSL 2.2 > < TSEL 2 >
- SECURITY Fix: Evgeny Legerov has reported a vulnerability in ProFTPD,
caused due to a buffer overflow error in the "main.c" file where the
"cmd_buf_size" size of the buffer used to handle FTP commands sent
by clients is not properly set to the size configured via the
"CommandBufferSize" directive. This can be exploited by malicious
people to compromise a vulnerable system.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2006-5815 to this issue.
- Security fix in mod_tls.
Action:
We recommend that all systems with this package installed be upgraded.
Please note that if you do not need the functionality provided by this
package, you may want to remove it from your system.
Location:
All Trustix Secure Linux updates are available from