diff -u linux-ftpd-ssl-0.17.18+0.3/ftpd/ftpd.c linux-ftpd-ssl-0.17.18+0.3/ftpd/ftpd.c --- linux-ftpd-ssl-0.17.18+0.3/ftpd/ftpd.c +++ linux-ftpd-ssl-0.17.18+0.3/ftpd/ftpd.c @@ -1729,7 +1729,7 @@ static FILE * dataconn(const char *name, off_t size, const char *mode, int stou) { char sizebuf[32]; - FILE *file; + FILE *file = NULL; int retry = 0, tos; file_size = size; @@ -1822,7 +1822,10 @@ ERR_error_string(ERR_get_error(),NULL)); perror_reply(425, errbuf); /* abort time methinks ... */ - fclose(file); + if(file != NULL){ + fclose(file); + file = NULL; + } return NULL; } else { if (ssl_debug_flag) { diff -u linux-ftpd-ssl-0.17.18+0.3/debian/changelog linux-ftpd-ssl-0.17.18+0.3/debian/changelog --- linux-ftpd-ssl-0.17.18+0.3/debian/changelog +++ linux-ftpd-ssl-0.17.18+0.3/debian/changelog @@ -1,12 +1,24 @@ -linux-ftpd-ssl (0.17.18+0.3-9ubuntu1) gutsy; urgency=low +linux-ftpd-ssl (0.17.18+0.3-9.1ubuntu1) hardy; urgency=low - * Merge from Debian unstable. Remaining Ubuntu changes: + * Merge from Debian unstable. Remaining Ubuntu changes: (LP: #176175) - debian/control: Add update-inetd to ftpd-ssl's dependencies - debian/control: Add openbsd-inetd | inet-superserver dependencies as ftpd-ssl needs an inet server to work + - debian/control: Bump to Standards-Version 3.7.3 + - debian/rules: Updated distclean * Modify Maintainer value to match Debian-Maintainer-Field Spec - -- Lionel Porcheron Fri, 04 May 2007 15:31:13 +0200 + -- Pedro Fragoso Thu, 13 Dec 2007 16:50:47 +0000 + +linux-ftpd-ssl (0.17.18+0.3-9.1) unstable; urgency=high + + * Non-maintainer upload by the testing-security team. + * Fix remote denial of service cause by passing an + uninitialized file stream to fopen().Initializing file + with NULL and checking for NULL before calling fclose() + fixes this (CVE-2007-6263; Closes: #454733). + + -- Nico Golde Mon, 10 Dec 2007 18:34:40 +0100 linux-ftpd-ssl (0.17.18+0.3-9) unstable; urgency=low @@ -30,15 +42,6 @@ -- Cai Qian Fri, 30 Mar 2007 16:00:00 +0800 -linux-ftpd-ssl (0.17.18+0.3-6ubuntu1) feisty; urgency=low - - * debian/control: Add update-inetd to ftpd-ssl's dependencies - (Closes Ubuntu: #76097). - * debian/control: Add openbsd-inetd | inet-superserver dependencies - as ftpd-ssl needs an inet server to work - - -- Lionel Porcheron Sun, 17 Dec 2006 10:30:13 +0100 - linux-ftpd-ssl (0.17.18+0.3-6) unstable; urgency=low * Move the certificate file to /etc/ftpd-ssl. Patch from James Westby diff -u linux-ftpd-ssl-0.17.18+0.3/debian/control linux-ftpd-ssl-0.17.18+0.3/debian/control --- linux-ftpd-ssl-0.17.18+0.3/debian/control +++ linux-ftpd-ssl-0.17.18+0.3/debian/control @@ -4,7 +4,7 @@ Maintainer: Ubuntu MOTU Developers XSBC-Original-Maintainer: Cai Qian Build-Depends: bison, debhelper (>= 4.0.0), libpam-dev, libssl-dev -Standards-Version: 3.7.2.1 +Standards-Version: 3.7.3 Package: ftpd-ssl Architecture: any diff -u linux-ftpd-ssl-0.17.18+0.3/debian/rules linux-ftpd-ssl-0.17.18+0.3/debian/rules --- linux-ftpd-ssl-0.17.18+0.3/debian/rules +++ linux-ftpd-ssl-0.17.18+0.3/debian/rules @@ -22,7 +22,7 @@ dh_testdir dh_testroot - -$(MAKE) distclean + -[ ! -f Makefile ] || $(MAKE) distclean dh_clean