|
| Current Newswire:
Debian Security Advisory: proftp runs as root, /var symlink removalMar 07, 2001, 08:04 (0 Talkback[s])Date: Tue, 6 Mar 2001 19:02:53 -0700 Debian Security Advisory DSA-032-1 security@debian.org http://www.debian.org/security/ Wichert Akkerman March 7, 2001 Package: proftpd Vulnerability: proftpd running as root, /var symlink removal Debian-specific: yesThe following problems have been reported for the version of proftpd in Debian 2.2 (potato): 1. There is a configuration error in the postinst script, when the user enters 'yes', when asked if anonymous access should be enabled. The postinst script wrongly leaves the 'run as uid/gid root' configuration option in /etc/proftpd.conf, and adds a 'run as uid/gid nobody' option that has no effect. 2. There is a bug that comes up when /var is a symlink, and proftpd is restarted. When stopping proftpd, the /var symlink is removed; when it's started again a file named /var is created. The above problems have been corrected in proftpd-1.2.0pre10-2.0potato1. We recommend you upgrade your proftpd package immediately.
wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.
You may use an automated update by adding the resources from the
footer to the proper configuration.
Debian GNU/Linux 2.2 alias potato Potato was released for the alpha, arm, i386, m68k, powerpc and sparc architectures. Source archives: Alpha architecture: ARM architecture: Intel ia32 architecture: Motorola 680x0 architecture: PowerPC architecture: Sun Sparc architecture: These files will be moved into ftp://ftp.debian.org/debian/dists/stable/*/binary-$arch/ soon. For not yet released architectures please refer to the appropriate directory ftp://ftp.debian.org/debian/dists/sid/binary-$arch/ . For apt-get: deb http://security.debian.org/
stable/updates main
|
