5531310 2000-09-29  18:22  /101 rader/ Brevbäraren (som är implementerad i) Python
Mottagare: Bugtraq (import) <12999>
Ärende: [slackware-security] wuftpd vulnerability - Slackware 4.0, 7.0,
------------------------------------------------------------
 7.1, -current
From: bump <chris@THEALANGROUP.COM>
To: BUGTRAQ@SECURITYFOCUS.COM
Message-ID: <003d01c02a1d$c438f860$8f585e3f@KONA>

----- Original Message -----
From: "Slackware Security Team" <security@slackware.com>
To: <slackware-security@slackware.com>
Sent: Friday, September 29, 2000 3:27 AM
Subject: [slackware-security] wuftpd vulnerability - Slackware 4.0, 7.0,
7.1, -current


A vulnerability involving an input validation error in the "site
exec" command has recently been identified in the wu-ftpd program
(CERT Advisory CA-2000-13).  More information about this problem can
be found at this site:

   http://www.cert.org/advisories/CA-2000-13.html

The wu-ftpd daemon is part of the tcpip1.tgz package in the N series.
A new tcpip1.tgz package is now available in the Slackware -current
tree.  All users of Slackware 7.0, 7.1, and -current are stronly
urged to upgrade to the new tcpip1.tgz package.

For users of Slackware 4.0, a wuftpd.tgz patch package is being
provided in the /patches tree of Slackware 4.0.


=========================================
wu-ftpd 2.6.1 AVAILABLE - (n1/tcpip1.tgz)
=========================================

   FOR USERS OF SLACKWARE 7.0, 7.1, and -current:
   ---------------------------------------------

   The recent vulnerability in wu-ftpd can be fixed by upgrading to
   the new tcpip1.tgz package.  This package upgrades the wu-ftpd
   server to version 2.6.1.  You can download it from the -current
   branch:


ftp://ftp.slackware.com/pub/slackware/slackware-current/slakware/n1/tcpip1.tgz

   All users of Slackware 7.0, 7.1, and -current are strongly urged
   to upgrade to the tcpip1.tgz package to fix the vulnerability in
   wu-ftpd.

   For verification purposes, we provide the following checksums:

      16-bit "sum" checksum:
      301822053 1017853 n1/tcpip1.tgz

      128-bit MD5 message digest:
      cbb3fe386341d1b1e99100ba3ff02794  n1/tcpip1.tgz

   Installation instructions for the tcpip1.tgz package:

      If you have downloaded the new tcpip1.tgz package, you should
      bring the system into runlevel 1 and run upgradepkg on it:

         # telinit 1
         # upgradepkg tcpip1.tgz
         # telinit 3



   FOR USERS OF SLACKWARE 4.0:
   --------------------------

   The recent vulnerability in wu-ftpd can be fixed by installing the
   wuftpd.tgz patch package.  This package upgrades the wu-ftpd
   server to version 2.6.1.  You can download it from the Slackware
   4.0 branch:

      ftp://ftp.slackware.com/pub/slackware/slackware-4.0/patches/wuftpd.tgz

   All users of Slackware 4.0 are strongly urged to install the
   wuftpd.tgz patch package to fix the vulnerability in wu-ftpd.

   For verification purposes, we provide the following checksums:

      16-bit "sum" checksum:
      2781503789 107341 wuftpd.tgz

      128-bit MD5 message digest:
      75547b1762d7ff4fad233cd89529ff2c  wuftpd.tgz

   Installation instructions for the wuftpd.tgz package:

      If you have downloaded the wuftpd.tgz patch package, you should
      bring the system into runlevel 1 and run installpkg on it:

         # telinit 1
         # installpkg wuftpd.tgz
         # telinit 3


Remember, it's also a good idea to backup configuration files before
upgrading packages.

- Slackware Linux Security Team
  http://www.slackware.com
(5531310) ------------------------------------------(Ombruten)