December 15, 2009, 4:19 pm
Resolved Bugs
544002 – Incorrect work proftpd server with the command “MLSD” and the directive
533125 – CVE-2009-3555 TLS: MITM attacks via session renegotiation
This update addresses CVE-2009-3555 (SSL/TLS renegotiation vulnerability), mitigating the problem by refusing all client-initiated SSL/TLS session renegotiations. This update to the latest maintenance release also fixes a number of bugs recorded in the proftpd bug tracker: – SSL/TLS renegotiation vulnerability (CVE-2009-3555, bug 3324) – Failed database transaction can cause mod_quotatab to loop (bug 3228) – Segfault in mod_wrap (bug 3332) – sections can have problems (bug 3337) – mod_wrap2 segfaults when a valid user retries the USER command (bug 3341) – mod_auth_file handles ‘getgroups’ request incorrectly (bug 3347) – Segfault caused by scrubbing zero-length portion of memory (bug 3350) Finally, the behaviour of the MLSD FTP command (used in many modern FTP clients to list directories) is fixed for the case when the FTP server’s configuration disallows its usage (using a clause) in some but not all places (#544002)…
