Test ID:	1.3.6.1.4.1.25623.1.0.54284
Category:	Trustix Local Security Checks
Title:	Trustix Security Advisory TSLSA-2004-0025 (libpng proftpd)
Summary:	NOSUMMARY
Description:	Description: The remote host is missing updates announced in advisory TSLSA-2004-0025. libpng: Steve Grubb discovered that libpng would access memory that is out of bounds when creating an error message. The impact of this bug is not clear, but it could lead to a core dump in a program using libpng, or could result in a DoS (Denial of Service) condition in a daemon that uses libpng to process PNG images. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0421 to this issue. proftpd: A portability workaround was applied in version 1.2.9 of the FTP server ProFTPD. As a side-effect, CIDR based (aaa.bbb.ccc.ddd/NN) ACL entries in Allow and Deny directives act like a AllowAll directive and so FTP clients are granted access to files and directories although the server configuration explicitly deny this access. This issue only affects proftpd 1.2.9, which is shipped with Trustix Secure Linux 2.1 and Trustix Secure Enterprise Linux 2. Trustix Secure Linux 2.0 uses proftpd 1.2.8, and is NOT affected by this issue. Solution: Update your system with the packages as indicated in the referenced security advisory. http://www.securityspace.com/smysecure/catid.html?in=TSLSA-2004-0025 Risk factor : Medium CVSS Score: 5.0
Cross-Ref:	BugTraq ID: 10244 Common Vulnerability Exposure (CVE) ID: CVE-2004-0421 http://lists.apple.com/mhonarc/security-announce/msg00056.html http://www.securityfocus.com/bid/10244 Bugtraq: 20040429 [OpenPKG-SA-2004.017] OpenPKG Security Advisory (png) (Google Search) http://marc.info/?l=bugtraq&m=108334922320309&w=2 Debian Security Information: DSA-498 (Google Search) http://www.debian.org/security/2004/dsa-498 http://marc.info/?l=fedora-announce-list&m=108451350029261&w=2 http://marc.info/?l=fedora-announce-list&m=108451353608968&w=2 http://www.mandriva.com/security/advisories?name=MDKSA-2004:040 http://www.mandriva.com/security/advisories?name=MDKSA-2006:212 http://www.mandriva.com/security/advisories?name=MDKSA-2006:213 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11710 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A971 http://www.redhat.com/support/errata/RHSA-2004-180.html http://www.redhat.com/support/errata/RHSA-2004-181.html http://secunia.com/advisories/22957 http://secunia.com/advisories/22958 http://marc.info/?l=bugtraq&m=108335030208523&w=2 XForce ISS Database: libpng-png-dos(16022) https://exchange.xforce.ibmcloud.com/vulnerabilities/16022
Copyright	Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.