Bug 34593

Summary:	Possible nasty ProFTPd security hole
Product:	[Retired] Red Hat Powertools	Reporter:	Chris Evans <chris>
Component:	proftpd	Assignee:	Tim Powers <timp>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	7.0	CC:	pbrown
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	i386
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2001-04-04 06:01:12 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Chris Evans 2001-04-03 23:45:24 UTC

Wheee... I get to use the new "Security issues"
group :-)
.
There is a draft CERT advisory circulating regarding
FTP servers and glob() related vulnerabilities and
overflows. The advisory has been posted to vendor-sec
which I believe lots of RedHat developers are on or
have access to.
.
In response to the CERT advisory, someone suggested
that ProFTPd was likely vulnerable. It would be cool
to check that, and if it is indeed vulnerable,
sneakily release RH7.1 powertools with a fixed
version so as to avoid a RH7.1 security update.

Comment 1 Bill Nottingham 2001-04-04 06:01:06 UTC

proftpd hasn't been in powertools since 6.0. ;)

Comment 2 Chris Evans 2001-04-05 21:02:00 UTC

All together now... "D'oh!!" :-)