Web Browser 로는 FTP 접속이 불가능 합니다.

문서번호 : 1260037898
업데이트 : 2009.12.06


상세내용

0.24.7-4.el48.2 update

- fixed CVE-2009-2473
- fixed CVE-2009-2474

CVE-2009-2473:
neon before 0.28.6, when expat is used, does not properly detect
recursion during entity expansion, which allows context-dependent
attackers to cause a denial of service (memory and CPU consumption)
via a crafted XML document containing a large number of nested entity
references, a similar issue to CVE-2003-1564.

CVE-2009-2474:
neon before 0.28.6, when OpenSSL or GnuTLS is used, does not properly
handle a '\0' character in a domain name in the subject's Common Name
(CN) field of an X.509 certificate, which allows man-in-the-middle
attackers to spoof arbitrary SSL servers via a crafted certificate
issued by a legitimate Certification Authority, a related issue to
CVE-2009-2408.


Autoupdates 지원 : Packages System
  pkgadd -F ngrep


update 패키지

  RPMS :
    . neon-0.24.7-4.el48.2.i686.rpm
    . neon-0.24.7-4.el48.2.i686.rpm

  SRPMS :

    . neon-0.24.7-4.el48.2.src.rpm


참고 :
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2473
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2474