Debian Security Advisory

DSA-057-1 gftp -- printf format attack

Date Reported:
08 May 2001
Affected Packages:
gftp
Vulnerable:
Yes
Security database references:
In Mitre's CVE dictionary: CVE-2001-0489.
More information:
The gftp package as distributed with Debian GNU/Linux 2.2 has a problem in its logging code: it logged data received from the network but it did not protect itself from printf format attacks. An attacker can use this by making an FTP server return special responses that exploit this.

This has been fixed in version 2.0.6a-3.1, and we recommend that you upgrade your gftp package.

Note: this advisory was posted as DSA-055-1 by mistake.

Fixed in:

Debian GNU/Linux 2.2 (potato)

Source:
http://security.debian.org/dists/stable/updates/main/source/gftp_2.0.6a-3.1.diff.gz
http://security.debian.org/dists/stable/updates/main/source/gftp_2.0.6a-3.1.dsc
http://security.debian.org/dists/stable/updates/main/source/gftp_2.0.6a.orig.tar.gz
Alpha:
http://security.debian.org/dists/stable/updates/main/binary-alpha/gftp_2.0.6a-3.1_alpha.deb
ARM:
http://security.debian.org/dists/stable/updates/main/binary-arm/gftp_2.0.6a-3.1_arm.deb
Intel IA-32:
http://security.debian.org/dists/stable/updates/main/binary-i386/gftp_2.0.6a-3.1_i386.deb
Motorola 680x0:
http://security.debian.org/dists/stable/updates/main/binary-m68k/gftp_2.0.6a-3.1_m68k.deb
PowerPC:
http://security.debian.org/dists/stable/updates/main/binary-powerpc/gftp_2.0.6a-3.1_powerpc.deb
Sun Sparc:
http://security.debian.org/dists/stable/updates/main/binary-sparc/gftp_2.0.6a-3.1_sparc.deb

MD5 checksums of the listed files are available in the original advisory.