[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[debian-users:37556] [Translate] [SECURITY] [DSA-338-1] New proftpd packages fix SQL injection

From: Seiji Kaneko <skaneko@xxxxxxxxxxxx>
Subject: [debian-users:37556] [Translate] [SECURITY] [DSA-338-1] New proftpd packages fix SQL injection
Date: Mon, 30 Jun 2003 23:50:37 +0900
List-help: <mailto:debian-users-ctl@debian.or.jp?body=help>
List-id: debian-users.debian.or.jp
List-owner: <mailto:debian-users-admin@debian.or.jp>
List-post: <mailto:debian-users@debian.or.jp>
List-software: fml [fml 4.0.3 release (20011202/4.0.3)]
List-unsubscribe: <mailto:debian-users-ctl@debian.or.jp?body=unsubscribe>
X-ml-info: If you have a question, send e-mail with the body "help" (without quotes) to the address debian-users-ctl@debian.or.jp; help=<mailto:debian-users-ctl@debian.or.jp?body=help>
X-ml-name: debian-users
X-mlserver: fml [fml 4.0.3 release (20011202/4.0.3)]; post only (only members can post)
X-spam-level:
X-spam-status: No, hits=-1.9 required=10.0 tests=ISO2022JP_BODY,SIGNATURE_SHORT_DENSE,SPAM_PHRASE_00_01 version=2.44
Message-id: <p04320408bb25fe7f74d8@xxxxxxxxxxxxxxx>
X-mail-count: 37556
X-mailer: Macintosh Eudora Version 4.3.2-J

かねこです。
URL 等は元記事を確認ください。

------>8------------>8------------>8------------>8------------>8
- --------------------------------------------------------------------------
Debian Security Advisory DSA 338-1                     security@debian.org
http://www.debian.org/security/                             Matt Zimmerman
June 29th, 2003                         http://www.debian.org/security/faq
- --------------------------------------------------------------------------

Package        : proftpd
Vulnerability  : SQL インジェクション
Problem-Type   : リモート
Debian-specific: いいえ

runlevel [runlevel@xxxxxxxxxxxx] さんから、ProFTPD の PostgreSQL 認証モジ
ュールを用いることで SQL インジェクション攻撃が可能であるとの報告がありま
した。この脆弱性を攻撃することで、リモートの攻撃者から他のユーザのパスワ
ードを読み取ったり、正しいパスワードなしに任意のユーザになりすまして 
ProFTPD に接続することなどが可能です。

現安定版 (stable) woody では、これはバージョン 1.2.4+1.2.5rc1-5woody2 で
修正されています。

不安定版 (unstable) sid では、これはバージョン 1.2.8-8 で修正されています。

直ぐに proftpd パッケージをアップグレードすることを勧めます。

インストール手順
----------------

wget url
	でファイルを取得できます。
dpkg -i file.deb
        で参照されたファイルをインストールできます。

apt-get パッケージマネージャを使っているなら、以下記載の sources.list
を用いて、次のコマンドを使ってください。

apt-get update
        これは内部データベースを更新します。
apt-get upgrade
        これで修正されたパッケージをインストールします。

本メールのフッタ記載の設定を自ホストの設定に加えることにより、自動更新を
行うこともできます。

Debian GNU/Linux 3.0 愛称 woody
- ------------------------------------

  ソースアーカイブ:

    http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.4+1.2.5rc1-5woody2.dsc
      Size/MD5 checksum:      727 b6bbf1fb682f160da85672afbd8cf848
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.4+1.2.5rc1-5woody2.tar.gz
      Size/MD5 checksum:   699016 bf322cedf80a02c936c9d4eda74131fc

  Architecture independent components:

    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-doc_1.2.4+1.2.5rc1-5woody2_all.deb
      Size/MD5 checksum:   281414 bc39191f1cfde5d1c3db3a0529da589f

  Alpha architecture:

    http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.4+1.2.5rc1-5woody2_alpha.deb
      Size/MD5 checksum:   205806 1fbcc7216485db7f69d01658a4694d14
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-common_1.2.4+1.2.5rc1-5woody2_alpha.deb
      Size/MD5 checksum:   107888 7d85d92a95bde52c601dd4da25640a39
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-ldap_1.2.4+1.2.5rc1-5woody2_alpha.deb
      Size/MD5 checksum:   216044 09a1bf535c009e48d7005249c57f5815
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-mysql_1.2.4+1.2.5rc1-5woody2_alpha.deb
      Size/MD5 checksum:   228806 272b734be4a08a6f8b84a8d15fab57ea
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-pgsql_1.2.4+1.2.5rc1-5woody2_alpha.deb
      Size/MD5 checksum:   228494 3dd63c4b61b15ff8ec6768ec070efa6f

  ARM architecture:

    http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.4+1.2.5rc1-5woody2_arm.deb
      Size/MD5 checksum:   172962 c17bac8e5ebd35c82d29bbd84cd06d93
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-common_1.2.4+1.2.5rc1-5woody2_arm.deb
      Size/MD5 checksum:    92170 dc5d6535ce88e8f1825a7f737a1f4abc
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-ldap_1.2.4+1.2.5rc1-5woody2_arm.deb
      Size/MD5 checksum:   181486 90cfca9474481183bbbdb935299e404e
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-mysql_1.2.4+1.2.5rc1-5woody2_arm.deb
      Size/MD5 checksum:   191796 78de889768d52230373761722d98e7fb
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-pgsql_1.2.4+1.2.5rc1-5woody2_arm.deb
      Size/MD5 checksum:   191710 27855567b8aa1d1afead2260d6e0d2dd

  Intel IA-32 architecture:

    http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.4+1.2.5rc1-5woody2_i386.deb
      Size/MD5 checksum:   159930 4061d5de926d8d180885ec88d8040ea5
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-common_1.2.4+1.2.5rc1-5woody2_i386.deb
      Size/MD5 checksum:    90388 7b0bd6058b1c90b5fc04cf436f8090a8
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-ldap_1.2.4+1.2.5rc1-5woody2_i386.deb
      Size/MD5 checksum:   167316 1c4c0d342c345f0a603dc86e85047f4d
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-mysql_1.2.4+1.2.5rc1-5woody2_i386.deb
      Size/MD5 checksum:   177320 aa31ecfee263f9be5971462998e3267f
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-pgsql_1.2.4+1.2.5rc1-5woody2_i386.deb
      Size/MD5 checksum:   177272 7d01955741d26cb234f126eb9656a262

  Intel IA-64 architecture:

    http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.4+1.2.5rc1-5woody2_ia64.deb
      Size/MD5 checksum:   260888 b8abfb2497ed8bfff3b053992d9146db
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-common_1.2.4+1.2.5rc1-5woody2_ia64.deb
      Size/MD5 checksum:   117100 4252bf31de41b04deaecba2a35d52dbf
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-ldap_1.2.4+1.2.5rc1-5woody2_ia64.deb
      Size/MD5 checksum:   273580 b195fc7455460dbbf1921c44160e83ff
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-mysql_1.2.4+1.2.5rc1-5woody2_ia64.deb
      Size/MD5 checksum:   292188 9548dad81719b86056f68575f3dc765b
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-pgsql_1.2.4+1.2.5rc1-5woody2_ia64.deb
      Size/MD5 checksum:   292012 2afd30e0551a7a7ab9e5e4250ea8c8ab

  HP Precision architecture:

    http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.4+1.2.5rc1-5woody2_hppa.deb
      Size/MD5 checksum:   199520 e9eec622d3574d67e161856fcfbaaa7e
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-common_1.2.4+1.2.5rc1-5woody2_hppa.deb
      Size/MD5 checksum:    94904 7598c44f2640d88ec5b1c1811ad9ee8a
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-ldap_1.2.4+1.2.5rc1-5woody2_hppa.deb
      Size/MD5 checksum:   209376 8656557f182a5ec635804229e4c24f9f
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-mysql_1.2.4+1.2.5rc1-5woody2_hppa.deb
      Size/MD5 checksum:   221864 7d02a0f2cd73438a2a155b35b0b87a5b
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-pgsql_1.2.4+1.2.5rc1-5woody2_hppa.deb
      Size/MD5 checksum:   221692 7e28806db27cd450e0828cbe5b15e679

  Motorola 680x0 architecture:

    http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.4+1.2.5rc1-5woody2_m68k.deb
      Size/MD5 checksum:   152734 e29c4c29549b404cad7ece71a235a97f
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-common_1.2.4+1.2.5rc1-5woody2_m68k.deb
      Size/MD5 checksum:    90916 d524e287cf50ac8d65b1745efd8f1eb5
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-ldap_1.2.4+1.2.5rc1-5woody2_m68k.deb
      Size/MD5 checksum:   159070 17d172d022c893fb21a465977efb67aa
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-mysql_1.2.4+1.2.5rc1-5woody2_m68k.deb
      Size/MD5 checksum:   168186 ba776d7a211d6c0811dfa4cfff8103d4
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-pgsql_1.2.4+1.2.5rc1-5woody2_m68k.deb
      Size/MD5 checksum:   168046 f539d7bb416b0a77af9b329fbb40bbdc

  Big endian MIPS architecture:

    http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.4+1.2.5rc1-5woody2_mips.deb
      Size/MD5 checksum:   184406 0cc53970e72ee6daa257e099bd393184
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-common_1.2.4+1.2.5rc1-5woody2_mips.deb
      Size/MD5 checksum:   103850 ab961f36d185f71be8560e413e0acd02
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-ldap_1.2.4+1.2.5rc1-5woody2_mips.deb
      Size/MD5 checksum:   192328 d62da22de9d68ee61499686b99ef5162
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-mysql_1.2.4+1.2.5rc1-5woody2_mips.deb
      Size/MD5 checksum:   203184 019e94b09e5ec82f858d39ccdfb98a9f
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-pgsql_1.2.4+1.2.5rc1-5woody2_mips.deb
      Size/MD5 checksum:   203062 187050f5af48a2f42e9f088ac873a18d

  Little endian MIPS architecture:

    http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.4+1.2.5rc1-5woody2_mipsel.deb
      Size/MD5 checksum:   185138 0ee63b58bb101dec2a6aa2c4a0c9db24
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-common_1.2.4+1.2.5rc1-5woody2_mipsel.deb
      Size/MD5 checksum:   103716 bc85d55e05a8080679e1db79025438ec
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-ldap_1.2.4+1.2.5rc1-5woody2_mipsel.deb
      Size/MD5 checksum:   192940 74169ef6f060184df30a5c4d40f202c2
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-mysql_1.2.4+1.2.5rc1-5woody2_mipsel.deb
      Size/MD5 checksum:   203962 8cf7f74f563d8545bfe1ff7315e22272
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-pgsql_1.2.4+1.2.5rc1-5woody2_mipsel.deb
      Size/MD5 checksum:   203786 a0314a061652ad0efaa0f8e2d7964825

  PowerPC architecture:

    http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.4+1.2.5rc1-5woody2_powerpc.deb
      Size/MD5 checksum:   175390 7e5c0ec43d7ca73ca4bf1f22a68fc137
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-common_1.2.4+1.2.5rc1-5woody2_powerpc.deb
      Size/MD5 checksum:    93304 d2ba0c7e16981d7ee13e0531fd1002e7
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-ldap_1.2.4+1.2.5rc1-5woody2_powerpc.deb
      Size/MD5 checksum:   183158 2ec2ebe5e3d681183540365fae46ba00
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-mysql_1.2.4+1.2.5rc1-5woody2_powerpc.deb
      Size/MD5 checksum:   193426 a919d347d1b8cb6e1989d679482cac7e
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-pgsql_1.2.4+1.2.5rc1-5woody2_powerpc.deb
      Size/MD5 checksum:   193304 59b9f59189145e3143e59711bbc1631b

  IBM S/390 architecture:

    http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.4+1.2.5rc1-5woody2_s390.deb
      Size/MD5 checksum:   166080 45b72cea50f10fc210eea80549988ade
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-common_1.2.4+1.2.5rc1-5woody2_s390.deb
      Size/MD5 checksum:    92152 2bdf3ffa8421b87927e84d51c033cbac
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-ldap_1.2.4+1.2.5rc1-5woody2_s390.deb
      Size/MD5 checksum:   173954 ce047bfc41b52cd69eb2a06f7f0d772c
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-mysql_1.2.4+1.2.5rc1-5woody2_s390.deb
      Size/MD5 checksum:   183348 44ff5a18066e9279073fec7f9f1effa9
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-pgsql_1.2.4+1.2.5rc1-5woody2_s390.deb
      Size/MD5 checksum:   183202 7e7a3ce1e040716124e49d25ddbceab5

  Sun Sparc architecture:

    http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.4+1.2.5rc1-5woody2_sparc.deb
      Size/MD5 checksum:   169568 74ef415c3b9191d26ca260d4b5f9f14d
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-common_1.2.4+1.2.5rc1-5woody2_sparc.deb
      Size/MD5 checksum:    92694 7cb9eb15c256582ebbe4ee2074633c19
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-ldap_1.2.4+1.2.5rc1-5woody2_sparc.deb
      Size/MD5 checksum:   177790 d0d1a7140862d474bf362c11ea7c9a6a
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-mysql_1.2.4+1.2.5rc1-5woody2_sparc.deb
      Size/MD5 checksum:   188380 9d6a93e06664f40d40c1c5f342af2680
    http://security.debian.org/pool/updates/main/p/proftpd/proftpd-pgsql_1.2.4+1.2.5rc1-5woody2_sparc.deb
      Size/MD5 checksum:   188210 bab4d525c2d5498efdc4fc936a9fc684

  これらのファイルは次の版の安定版リリース時そちらに移されます。

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
------>8------------>8------------>8------------>8------------>8
-- 
Seiji Kaneko                              skaneko@xxxxxxxxxxxx
--------------------------- http://plaza25.mbn.or.jp/~efialtes
足跡 = 55A4 898A C765 F20A 1693  7882 579A 3339 D6ED 97E8

Prev by Date: [debian-users:37555] Re: 突然、ネットサーフィン出来なくなりました。
Next by Date: [debian-users:37557] [Translate] [SECURITY] [DSA-337-1] New gtksee packages fix buffer overflow
Previous by thread: [debian-users:37550] Forward: [SECURITY] [DSA-338-1] New proftpd packages fix SQL injection
Next by thread: [debian-users:37557] [Translate] [SECURITY] [DSA-337-1] New gtksee packages fix buffer overflow
Index(es):
- Date
- Thread