------------------------------------------------------------------------------- GENTOO LINUX SECURITY ANNOUNCEMENT 200310-02 ------------------------------------------------------------------------------- Package : cfengine Summary : stack overflow in cfengine network code Date : 2003-10-04 23:30 UTC Exploit : remote Versions Affected : < 2.0.8, 2.1.0a6-a9 Fixed Version : >= 2.0.8, >=2.1.0b1 Gentoo Bug ID : 28910 CVE : we are not aware of any at this time ------------------------------------------------------------------------------- DESCRIPTION =========== From the bugtraq posting: "There is an exploitable stack overflow in the network I/O code used in the cfservd daemon in Cfengine 2.x prior to version 2.0.8. Arbitrary code execution has been demonstrated on x86 FreeBSD and is believed to be possible on all platforms. Cfengine 1 is not vulnerable, but downgrading is not recommended as version 1 is nolonger supported by the author." Read the full advisory at: http://packetstormsecurity.nl/0309-advisories/cfengine.txt SOLUTION ======== It is recommended that all Gentoo Linux users who are using net-misc/cfengine upgrade to a fixed version. emerge sync emerge -p cfengine emerge cfengine emerge clean ------------------------------------------------------------------------------- Kurt Lieber klieber@xxxxxxxxxx GPG Key is available at http://dev.gentoo.org/~klieber/klieber.gpg -------------------------------------------------------------------------------
Attachment:
pgpnKJOlWJywS.pgp
Description: PGP signature