Debian Security Advisory: proftp runs as root, /var symlink removalMar 07, 2001, 08:04 (0 Talkback[s])
Date: Tue, 6 Mar 2001 19:02:53 -0700
Debian Security Advisory DSA-032-1 firstname.lastname@example.org http://www.debian.org/security/ Wichert Akkerman March 7, 2001
Package: proftpd Vulnerability: proftpd running as root, /var symlink removal Debian-specific: yesThe following problems have been reported for the version of proftpd in Debian 2.2 (potato):
1. There is a configuration error in the postinst script, when the user enters 'yes', when asked if anonymous access should be enabled. The postinst script wrongly leaves the 'run as uid/gid root' configuration option in /etc/proftpd.conf, and adds a 'run as uid/gid nobody' option that has no effect.
2. There is a bug that comes up when /var is a symlink, and proftpd is restarted. When stopping proftpd, the /var symlink is removed; when it's started again a file named /var is created.
The above problems have been corrected in proftpd-1.2.0pre10-2.0potato1. We recommend you upgrade your proftpd package immediately.
wget url will fetch the file for you dpkg -i file.deb will install the referenced file.You may use an automated update by adding the resources from the footer to the proper configuration.
Debian GNU/Linux 2.2 alias potato
Potato was released for the alpha, arm, i386, m68k, powerpc and sparc architectures.
Intel ia32 architecture:
Motorola 680x0 architecture:
Sun Sparc architecture:
These files will be moved into ftp://ftp.debian.org/debian/dists/stable/*/binary-$arch/ soon.
For not yet released architectures please refer to the appropriate directory ftp://ftp.debian.org/debian/dists/sid/binary-$arch/ .
For apt-get: deb http://security.debian.org/