RHBA-2012:0790 - Bug Fix Advisory

Topic

Updated vsftpd packages that fix multiple bugs are now available for Red Hat
Enterprise Linux 6.

Description

The vsftpd package provides the VSFTP (Very Secure File Transfer Protocol)
daemon.

This update fixes the following bugs:

• Prior to this update, the configuration file specified the wrong default log

file. As a consequence, the logrotate script could not find and consequently
rotate the vsftpd log file which resulted in an unnecessarily large vsftpd log.
This update specifies /var/log/xferlog as its default log file in
/etc/vsftpd/vsftpd.conf, which enables log rotation on vsftpd log files.
(BZ#701300)

• Prior to this update, the RLIMIT_AS value (100 MB) was insufficient. As a

consequence, LDAP could not use vsftpd for authentication to the system. This
update increases the initial RLIMIT_AS value to 200 MB, and vsftpd now can be
used for LDAP authentication as expected. (BZ#708657)

• Prior to this update, vsftpd did not handle file transfer failures correctly

if the ftp-data port was blocked on the File Transfer Protocol (FTP) client. As
a consequence, vsftpd could become unresponsive. This update modifies the
underlying code so that the vsftp daemon reports such failures to the FTP client
and the data transfer is now terminated as expected. (BZ#717411)

• Prior to this update, the man page of the vsftpd.conf file contained incorrect

default values for "max_per_ip" and "max_clients" options. This update
introduces the correct default values for these two options. (BZ#745133)

• Prior to this update, the DNS reverse lookup feature could not be disabled.

This update adds the "reverse_lookup_enable" parameter, which allows to enable
or disable the DNS reverse lookup functionality. (BZ#752954)

• Prior to this update, vsftpd also listed the CHMOD command when the

"chmod_enable" option was disabled. This update modifies the help file so that
vsftpd no longer lists the CHMOD command when the command is disabled.
(BZ#765757)

• Prior to this update, listing files could cause an overflow error if a

directory contained files with a User or Group ID that was higher then the
maximum value 2147483647 of the "signed int" data type. As a consequence, the
FTP connection was terminated. This update modifies vsftpd to support UIDs and
GIDs above the maximum value of the "unsigned int" data type. Directory content
is now listed as expected in the scenario described. (BZ#785061)

• Prior to this update, the ls command did not support square brackets as

wildcard characters in FTP connections. This update improves wildcard characters
support in vsftpd and square brackets can now be used in regular expressions
with the ls command. (BZ#785084)

• Prior to this update, the "listen()" function in vsftpd could, under certain

circumstances, fail under heavy load. As a consequence, the socket became
blocked. This update closes failed sockets and creates new a socket to cointinue
listening. (BZ#785642)

All users of vsftpd are advised to upgrade to these updated packages, which fix
these bugs.

Solution

Before applying this update, make sure all previously-released errata relevant
to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the Red
Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 i386
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 6 s390x
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension (for IBM z Systems) 6 s390x

Fixes

• BZ - 708657 - Update to rhel 6.1 broke vsftpd authentication when using ldap
• BZ - 785084 - vsftpd can not handle square brackets in ls

CVEs

(none)

References

(none)