|Main Archive Page > Month Archives > enterprise-watch-list archives|
-----BEGIN PGP SIGNED MESSAGE-----
An updated lftp package that fixes one security issue and various bugs is now available for Red Hat Enterprise Linux 5.
This update has been rated as having low security impact by the Red Hat Security Response Team.
2. Relevant releases/architectures:
Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64
LFTP is a sophisticated file transfer program for the FTP and HTTP protocols. Like bash, it has job control and uses the readline library for input. It has bookmarks, built-in mirroring, and can transfer several files in parallel. It is designed with reliability in mind.
It was discovered that lftp did not properly escape shell metacharacters when generating shell scripts using the "mirror --script" command. A mirroring script generated to download files from a malicious FTP server could allow an attacker controlling the FTP server to run an arbitrary command as the user running lftp. (CVE-2007-2348)
This update also fixes the following bugs:
Note: This update upgrades LFTP from version 3.7.3 to upstream version 3.7.11, which incorporates a number of further bug fixes to those noted above. For details regarding these fixes, refer to the "/usr/share/doc/lftp-3.7.11/NEWS" file after installing this update. (BZ#308721)
All LFTP users are advised to upgrade to this updated package, which resolves these issues.
Before applying this update, make sure that all previously-released errata relevant to your system have been applied.
This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/docs/DOC-11259
5. Bugs fixed (http://bugzilla.redhat.com/): 236238 - CVE-2007-2348 lftp mirror --script does not escape names and targets of symbolic links 239334 - lftp affected by problems described in CVE-2007-2348 308721 - bump lftp to current version 3.7.11 422881 - Using lftp with -c options causes hangs 434294 - lftp corrupts data when using (m)put's -c option on sftp transport 461922 - [RHEL 5] lftp 'help mirror' does not display all options defined in manpage.
6. Package List:
Red Hat Enterprise Linux Desktop (v. 5 client):
Red Hat Enterprise Linux (v. 5 server):
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package
The Red Hat security contact is <email@example.com>. More contact details at https://www.redhat.com/security/team/contact/
Copyright 2009 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)
-----END PGP SIGNATURE----- -- Enterprise-watch-list mailing list Enterprisefirstname.lastname@example.org https://www.redhat.com/mailman/listinfo/enterprise-watch-list