Issue

• CVE-2009-5029 was fixed on RHEL6.2.z and is not fixed yet on any other versions.

• BZ: https://bugzilla.redhat.com/show_bug.cgi?id=761245

• Our partner has already confirmed this problem can be reproduced on RHEL5.4 and RHEL5.8 snapshot5.

• Please answer the following three questions about it.

(1) How about the impact of this problem and what kind of programs are affected by this problem? The customer uses vsftpd, which is known as affected by this problem, on some of their systems. So they want to know whether this vulnerability is a serious problem for them or not and also are there other program they should care about, or not.

(2) What is the workaround of this problem? (if exist)

(3) Do you have a plan to fix this problem for RHEL5.x? If yes, where are you going to do so and for which version the async errata will be provided? If no, why you do not do so?