RHBA-2007:0793 - Bug Fix Advisory

Topic

Updated vsftpd packages that fix various bugs are now available.

Description

The vsftpd package includes a Very Secure FTP (File Transfer Protocol)
daemon.

These updated packages fix the following issues:

• files uploaded by anonymous users were given incorrect permissions even

if a umask was set using "anon_umask=" in vsftpd.conf.

• using wildcards in conjunction with the 'ls' command did not return all

the filenames it should. For example, if you FTPed into a directory
containing three files -- A1, A21 and A11 -- and ran 'ls *1", only the
filenames A1 and A21 were returned. The updated package now uses greedier
code that continues to speculatively scan for items even after matches have
been found.

• when "user_config_dir=" is enabled in vsftpd.conf, the following error

occurred after entering your password during the log in process:

500 OOPS: reading non-root config file Login failed. 421 Service not
available, remote server has closed connection

All vsftpd users should upgrade to these updated packages, which resolve
these issues.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188

Affected Products

• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux for IBM z Systems 4 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390
• Red Hat Enterprise Linux for Power, big endian 4 ppc

Fixes

• BZ - 244864 - vsftpd file listing issue with wildcard

CVEs

(none)

References

(none)