Fedora has issued an advisory on September 28: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/377GOOKDT66IY5TCU6WVXZOENVHNQTJO/ They fixed it in this commit: http://pkgs.fedoraproject.org/cgit/rpms/pure-ftpd.git/commit/?h=f26&id=749308ee9d298aae7dc182debdd77b702a6d7e46 Our package may be affected in Cauldron, but older versions wouldn't be.
Component: RPM Packages => SecurityQA Contact: (none) => security
Assignee: cjw => smelrorCC: (none) => smelror
Hi. Pure-ftpd 1.0.47 has been pushed to Cauldron with the patch from Fedora. Cheers, Stig
Whiteboard: (none) => MGA6TOO
Pure-ftpd 1.0.47 uploaded to 6/updates_testing. Files: pure-ftpd-1.0.47-1.mga6.rpm pure-ftpd-anon-upload-1.0.47-1.mga6.rpm pure-ftpd-anonymous-1.0.47-1.mga6.rpm pure-ftpd-debuginfo-1.0.47-1.mga6.rpm From: pure-ftpd-1.0.47-1.mga6.src.rpm Cheers, Stig
Assignee: smelror => qa-bugs
Removing cauldron.
CC: (none) => shlomifWhiteboard: MGA6TOO => (none)Version: Cauldron => 6
Advisory: ======================== This is an update fixing loading the configuration file. References: CVE-2017-12170 pure-ftpd: Ignoring existing configuration after update due to packaging error https://bugzilla.redhat.com/show_bug.cgi?id=1493114 https://nvd.nist.gov/vuln/detail/CVE-2017-12170 Updated packages in core/updates_testing: ======================== pure-ftpd-1.0.47-1.mga6 pure-ftpd-anon-upload-1.0.47-1.mga6 pure-ftpd-anonymous-1.0.47-1.mga6 pure-ftpd-debuginfo-1.0.47-1.mga6 from pure-ftpd-1.0.47-1.mga6.src.rpm
CVE: (none) => CVE-2017-12170
Mageia 6 :: x86_64 Not sure what is happening here. The online documentation recommended a somewhat esoteric procedure for running this. Installed the pre-update packages and used systemctl to enable and start pure-ftpd as a service. That seemed to work and it was possible to invoke ftp at the commandline and transfer files across the LAN - the simplest test I could think of. Updated the packages and tried this again but then it would not restart - the control process exited immediately. Tried removing the packages and reinstalling but it still failed to start. Last try, as root: # pure-ftpd & It worked OK that way for a user. So is this the way it is meant to be used?
CC: (none) => tarazed25
Len. Thanks for your report. This issue has been fixed and pure-ftpd is building now. Will let you know when the new build is available. Cheers, Stig
Advisory: ======================== This is an update fixing loading the configuration file. References: CVE-2017-12170 pure-ftpd: Ignoring existing configuration after update due to packaging error https://bugzilla.redhat.com/show_bug.cgi?id=1493114 https://nvd.nist.gov/vuln/detail/CVE-2017-12170 Updated packages in core/updates_testing: ======================== pure-ftpd-1.0.47-1.1.mga6 pure-ftpd-anon-upload-1.0.47-1.1.mga6 pure-ftpd-anonymous-1.0.47-1.1.mga6 pure-ftpd-debuginfo-1.0.47-1.1.mga6 from pure-ftpd-1.0.47-1.1.mga6.src.rpm
Keywords: (none) => advisory
Keywords: advisory => (none)CC: (none) => tmb
Mageia 6 :: x86_64 Updated pure-ftpd packages and finally figured out how it starts. systemctl indicated that it was enabled as a service and after a reboot showed that it was running normally. Double-checked that the process was there. $ ps aux | grep pure-ftpd root 2522 0.0 0.0 46668 680 ? Ss 10:42 0:00 pure-ftpd (SERVER) There is a problem though. How does one override /bin/ftp when using the command line for local operations? Or does the ftp command automatically use the service if it is running?
Hi Len. I don't like the ftp command. On every install I do, I install ncftp. But as far as pure-ftpd concerns, it looks like it's running as it should. Cheers, Stig
Thanks Stig. Reading between the lines that indicates that ftp would be using pure-ftp. However I shall install ncftp and use that to finish the report.
Logged in to another machine on the LAN and exercized some of the commands like copying a file to the host machine. The shell commands all seemed to work OK. $ ncftp -u lcl -p <password> belexeuli NcFTP 3.2.5 (Feb 02, 2011) by Mike Gleason (http://www.NcFTP.com/contact/). Connecting to 192.168.1.156... ProFTPD 1.3.5e Server (ProFTPD Default Installation) [192.168.1.156] Logging in... User lcl logged in Logged in to belexeuli. ncftp /home/lcl > cd ruby/local ncftp /home/lcl/ruby/local > get psrepair.rb psrepair.rb: 300.00 B 10.09 kB/s ncftp /home/lcl/ruby/local > cd ncftp /home/lcl > ....... Lost connection ncftp> open -u lcl -p <password> belexeuli Connecting to 192.168.1.156... ProFTPD 1.3.5e Server (ProFTPD Default Installation) [192.168.1.156] Logging in... User lcl logged in Logged in to belexeuli. ncftp /home/lcl > put LochEck_0003.jpg LochEck_0003.jpg: 12.59 MB 4.72 MB/s ncftp /home/lcl > quit Tried an external site: $ ncftp ftp://128.10.252.10/pub/ NcFTP 3.2.5 (Feb 02, 2011) by Mike Gleason (http://www.NcFTP.com/contact/). Connecting to 128.10.252.10... ::ffff:128.10.252.10 FTP server ready Logging in... Anonymous access granted, restrictions apply Logged in to 128.10.252.10. Current remote directory is /pub. ncftp /pub > ls advisories/ doc/ ls-lR tools/ dict/ lists/ os/ ncftp /pub > ls dict dictionaries/ local/ README.txt wordlists/ ncftp /pub > cd dict ------------------------------------------------------------------------ Purdue University CERIAS - Security Archive ------------------------------------ Center for Education and Research in Information Assurance and Security All comments may be directed to security-archive@cerias.purdue.edu ------------------------------------------------------------------------ This is a collection of miscellaneous dictionary files from many places, it is currently a bit messy, so look through and find what you want. CWD command successful ncftp /pub/dict > ls dictionaries DanKlein/ English/ Hindi/ Swedish/ DEC-collection/ Finnish/ Italian/ Dutch/ German/ Norwegian/ ncftp /pub/dict > cd dictionaries/Dutch ncftp ...ict/dictionaries/Dutch > ncftp ...ict/dictionaries/Dutch > get words.dutch.Z words.dutch.Z: 779056 bytes 443.48 kB/s ncftp ...ict/dictionaries/Dutch > quit This all works as well as expected. Giving it a 64-bit OK.
Whiteboard: (none) => MGA6-64-OK
Rider to comment 11: Noting the ProFTPD notice on the belexeuli login I tried the connection from the other end (belexeuli) to check which server vega was using. Installed pure-ftpd on belexeuli and rebooted. Opened a FTP session on belexeuli: $ ftp vega Connected to vega. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220-You are user number 1 of 50 allowed. which clinches it. Everything is OK.
Keywords: (none) => validated_updateCC: (none) => sysadmin-bugs
Keywords: (none) => advisoryCC: (none) => davidwhodgins
An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2018-0108.html
Status: NEW => RESOLVEDResolution: (none) => FIXED