Your message dated Sun, 14 Nov 2010 22:10:12 +0100
with message-id <20101114211012.gq5...@radis.liafa.jussieu.fr>
and subject line Re: Bug#603511: proftpd: cve-2010-4221 remote code execution
vulnerability
has caused the Debian Bug report #603511,
regarding proftpd: cve-2010-4221 remote code execution vulnerability
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)
--
603511: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=603511
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Package: proftpd-dfsg
Version: 1.3.1-17lenny4
Severity: grave
Tags: security , patch
Hi,
the following CVE (Common Vulnerabilities & Exposures) id was
published for proftpd-dfsg.
CVE-2010-4221[0]:
| Multiple stack-based buffer overflows in the pr_netio_telnet_gets
| function in netio.c in ProFTPD before 1.3.3c allow remote attackers to
| execute arbitrary code via vectors involving a TELNET IAC escape
| character to a (1) FTP or (2) FTPS server.
Patch available:
http://bugs.proftpd.org/show_bug.cgi?id=3521
If you fix the vulnerability please also make sure to include the
CVE id in your changelog entry.
For further information see:
[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4221
http://security-tracker.debian.org/tracker/CVE-2010-4221
--- End Message ---
--- Begin Message ---
On Sun, Nov 14, 2010 at 15:46:09 -0500, Michael Gilbert wrote:
> Package: proftpd-dfsg
> Version: 1.3.1-17lenny4
> Severity: grave
> Tags: security , patch
>
> Hi,
> the following CVE (Common Vulnerabilities & Exposures) id was
> published for proftpd-dfsg.
>
> CVE-2010-4221[0]:
> | Multiple stack-based buffer overflows in the pr_netio_telnet_gets
> | function in netio.c in ProFTPD before 1.3.3c allow remote attackers to
> | execute arbitrary code via vectors involving a TELNET IAC escape
> | character to a (1) FTP or (2) FTPS server.
>
Sounds like a dupe of 602279, which is fixed in sid/squeeze and doesn't
affect lenny. Please reopen if that's wrong.
Cheers,
Julien
signature.asc
Description: Digital signature
--- End Message ---
