Bug 457274 - filezilla: unhandled SSL/TLS errors causing unnoticed incomplete downloads
filezilla: unhandled SSL/TLS errors causing unnoticed incomplete downloads
Status: CLOSED CURRENTRELEASE
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
low Severity low
: ---
: ---
Assigned To: Red Hat Product Security
: Security
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2008-07-30 12:10 EDT by Tomas Hoger
Modified: 2008-07-31 21:49 EDT (History)
1 user (show)

See Also:
Fixed In Version: 3.1.0.1-1.fc8
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2008-07-31 21:47:24 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Tomas Hoger 2008-07-30 12:10:55 EDT
FileZilla Client version 3.1.0.1 fixes a minor security issue:

Quoting upstream news page:

FileZilla 3.1.0.1 fixes a vulnerability regarding the way some errors are
handled on SSL/TLS secured data transfers.

If the data connection of a transfer gets closed, FileZilla did not check if the
server performed an orderly TLS shutdown.

Impact:
An attacker could send spoofed FIN packets to the client. Even though GnuTLS
detects this with GNUTLS_E_UNEXPECTED_PACKET_LENGTH, FileZilla did not record a
transfer failure in all cases.

Unfortunately not all servers perform an orderly SSL/TLS shutdown. Since this
cannot be distinguished from an attack, FileZilla will not be able to download
listings or files from such servers.

Affected versions:
All versions prior to 3.1.0.1 are affected. This vulnerability has been fixed in
3.1.0.1

Reference:
http://filezilla-project.org/
Comment 1 Fedora Update System 2008-07-30 16:08:55 EDT
filezilla-3.1.0.1-1.fc9 has been pushed to the Fedora 9 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update filezilla'.  You can provide feedback for this update here: http://admin.fedoraproject.org/updates/F9/FEDORA-2008-6865
Comment 2 Fedora Update System 2008-07-31 21:47:17 EDT
filezilla-3.1.0.1-1.fc8 has been pushed to the Fedora 8 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 3 Fedora Update System 2008-07-31 21:49:48 EDT
filezilla-3.1.0.1-1.fc9 has been pushed to the Fedora 9 stable repository.  If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.