From klieber@gentoo.org Sun Oct 5 21:05:34 2003 From: Kurt Lieber To: full-disclosure@lists.netsys.com Date: Sun, 5 Oct 2003 12:23:48 -0400 Subject: [Full-Disclosure] GLSA: cfengine (200310-02) ------------------------------------------------------------------------------- GENTOO LINUX SECURITY ANNOUNCEMENT 200310-02 ------------------------------------------------------------------------------- Package : cfengine Summary : stack overflow in cfengine network code Date : 2003-10-04 23:30 UTC Exploit : remote Versions Affected : < 2.0.8, 2.1.0a6-a9 Fixed Version : >= 2.0.8, >=2.1.0b1 Gentoo Bug ID : 28910 CVE : we are not aware of any at this time ------------------------------------------------------------------------------- DESCRIPTION =========== From the bugtraq posting: "There is an exploitable stack overflow in the network I/O code used in the cfservd daemon in Cfengine 2.x prior to version 2.0.8. Arbitrary code execution has been demonstrated on x86 FreeBSD and is believed to be possible on all platforms. Cfengine 1 is not vulnerable, but downgrading is not recommended as version 1 is nolonger supported by the author." Read the full advisory at: http://packetstormsecurity.nl/0309-advisories/cfengine.txt SOLUTION ======== It is recommended that all Gentoo Linux users who are using net-misc/cfengine upgrade to a fixed version. emerge sync emerge -p cfengine emerge cfengine emerge clean ------------------------------------------------------------------------------- Kurt Lieber klieber@gentoo.org GPG Key is available at http://dev.gentoo.org/~klieber/klieber.gpg ------------------------------------------------------------------------------- [ Part 2, Application/PGP-SIGNATURE 196bytes. ] [ Unable to print this part. ]