oss-security - Re: vsftpd CVE-2007-5962 (Red Hat / Fedora specific)

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / news community lists wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [<thread-prev] [thread-next>] [month] [year] [list]

Date: Wed, 21 May 2008 11:34:42 -0800
From: Jonathan Smith <smithj@...ethemallocs.com>
To: oss-security@...ts.openwall.com
CC: chris@...ry.beasts.org
Subject: Re: vsftpd CVE-2007-5962 (Red Hat / Fedora specific)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Tomas Hoger wrote:
| This is just a heads-up.  We are releasing updated vsftpd packages
| containing a fix for a minor memory leak identified by CVE-2007-5962.

The memory leak itself is CVE-2007-5962? Or is the CVE for the original
issue where deny_hosts didn't work as expected? It doesn't seem to be
public.

| The issue occurred because of the Red Hat / Fedora specific patch
| which, according to information from our vsftpd maintainer, is not in
| upstream.  I also checked few major vendors, it seems no one is using
| the patch.

rPath/Foresight does :-/

| More details in our BZ:
|
| https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2007-5962

Thanks for the heads-up.

	smithj

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.9 (GNU/Linux)

iEYEARECAAYFAkg0eVEACgkQCG91qXPaRemHagCfck874lv1ONGXaZPPGRWo0i6x
R3AAnRE/9lpHs8D4NAYSV59MudHSoLRy
=ZSXA
-----END PGP SIGNATURE-----

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.