bugtraq - GLSA: cfengine (200310-02)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Sun, 5 Oct 2003 12:24:45 -0400
From: Kurt Lieber <klieber@...too.org>
To: bugtraq@...urityfocus.com
Subject: GLSA: cfengine (200310-02)

-------------------------------------------------------------------------------
GENTOO LINUX SECURITY ANNOUNCEMENT 200310-02
-------------------------------------------------------------------------------
          Package : cfengine
          Summary : stack overflow in cfengine network code
             Date : 2003-10-04 23:30 UTC
          Exploit : remote
Versions Affected : < 2.0.8, 2.1.0a6-a9
    Fixed Version : >= 2.0.8, >=2.1.0b1
    Gentoo Bug ID : 28910
              CVE : we are not aware of any at this time
-------------------------------------------------------------------------------

DESCRIPTION
===========

From the bugtraq posting:

"There is an exploitable stack overflow in the network I/O code used in the
cfservd daemon in Cfengine 2.x prior to version 2.0.8.  Arbitrary code
execution has been demonstrated on x86 FreeBSD and is believed to be possible
on all platforms.

Cfengine 1 is not vulnerable, but downgrading is not recommended as version 1
is nolonger supported by the author."

Read the full advisory at:
http://packetstormsecurity.nl/0309-advisories/cfengine.txt


SOLUTION
========

It is recommended that all Gentoo Linux users who are using net-misc/cfengine
upgrade to a fixed version.

emerge sync
emerge -p cfengine
emerge cfengine
emerge clean

-------------------------------------------------------------------------------
Kurt Lieber          
klieber@...too.org

GPG Key is available at http://dev.gentoo.org/~klieber/klieber.gpg
-------------------------------------------------------------------------------

Content of type "application/pgp-signature" skipped