Bug 457274 - filezilla: unhandled SSL/TLS errors causing unnoticed incomplete downloads
Summary: filezilla: unhandled SSL/TLS errors causing unnoticed incomplete downloads
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2008-07-30 16:10 UTC by Tomas Hoger
Modified: 2008-08-01 01:49 UTC (History)
1 user (show)

Fixed In Version: 3.1.0.1-1.fc8
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2008-08-01 01:47:24 UTC


Attachments (Terms of Use)

Description Tomas Hoger 2008-07-30 16:10:55 UTC
FileZilla Client version 3.1.0.1 fixes a minor security issue:

Quoting upstream news page:

FileZilla 3.1.0.1 fixes a vulnerability regarding the way some errors are
handled on SSL/TLS secured data transfers.

If the data connection of a transfer gets closed, FileZilla did not check if the
server performed an orderly TLS shutdown.

Impact:
An attacker could send spoofed FIN packets to the client. Even though GnuTLS
detects this with GNUTLS_E_UNEXPECTED_PACKET_LENGTH, FileZilla did not record a
transfer failure in all cases.

Unfortunately not all servers perform an orderly SSL/TLS shutdown. Since this
cannot be distinguished from an attack, FileZilla will not be able to download
listings or files from such servers.

Affected versions:
All versions prior to 3.1.0.1 are affected. This vulnerability has been fixed in
3.1.0.1

Reference:
http://filezilla-project.org/

Comment 1 Fedora Update System 2008-07-30 20:08:55 UTC
filezilla-3.1.0.1-1.fc9 has been pushed to the Fedora 9 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update filezilla'.  You can provide feedback for this update here: http://admin.fedoraproject.org/updates/F9/FEDORA-2008-6865

Comment 2 Fedora Update System 2008-08-01 01:47:17 UTC
filezilla-3.1.0.1-1.fc8 has been pushed to the Fedora 8 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 3 Fedora Update System 2008-08-01 01:49:48 UTC
filezilla-3.1.0.1-1.fc9 has been pushed to the Fedora 9 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.