1. Home
  2. Security Advisories
  3. Fedora
  4. FEDORA-2009-13250

[FEDORA-2009-13250] Fedora 12: proftpd

Severity Medium
Affected Packages 1
CVEs 1
Info Packages References Vulnerabilities

This update addresses CVE-2009-3555 (SSL/TLS renegotiation vulnerability),
mitigating the problem by refusing all client-initiated SSL/TLS session
renegotiations. This update to the latest maintenance release also fixes a
number of bugs recorded in the proftpd bug tracker: - SSL/TLS renegotiation
vulnerability (CVE-2009-3555, bug 3324) - Failed database transaction can cause
mod_quotatab to loop (bug 3228) - Segfault in mod_wrap (bug 3332) -
<Directory> sections can have <Limit> problems (bug 3337) - mod_wrap2 segfaults
when a valid user retries the USER command (bug 3341) - mod_auth_file handles
'getgroups' request incorrectly (bug 3347) - Segfault caused by scrubbing zero-
length portion of memory (bug 3350) Finally, the behaviour of the MLSD FTP
command (used in many modern FTP clients to list directories) is fixed for the
case when the FTP server's configuration disallows its usage (using a <Limit>
clause) in some but not all places (#544002).

Package Affected Version
pkg:rpm/fedora/proftpd?distro=fedora-12 < 1.3.2c.1.fc12
ID
FEDORA-2009-13250
Severity
medium
Severity from
CVE-2009-3555
URL
https://bodhi.fedoraproject.org/updates/FEDORA-2009-13250
Published
2009-12-27T20:24:34
(14 years ago)
Modified
2009-12-27T20:24:34
(14 years ago)
Rights
Copyright 2009 Red Hat, Inc.
Other Advisories
Source # ID Name URL
Bugzilla 533125 Bug #533125 - CVE-2009-3555 TLS: MITM attacks via session renegotiation https://bugzilla.redhat.com/show_bug.cgi?id=533125
Type Package URL Namespace Name / Product Version Distribution / Platform Arch Patch / Fix
Affected pkg:rpm/fedora/proftpd?distro=fedora-12 fedora proftpd < 1.3.2c.1.fc12 fedora-12
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories Exploits PoC Pubblication Date Modification Date
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories PoC Pubblication Date Modification Date