Users login

Create an account »

JOIN XATRIX

Users login

Home » Hacking News » Gentoo 200304-03: setiathome buffer overflow

Gentoo 200304-03: setiathome buffer overflow

by Nikola Strahija on April 14th, 2003 A buffer overflow vulnerability has been found in Setiathome client which is triggered by sending and overly large string followed by a newline character.


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- - ---------------------------------------------------------------------
GENTOO LINUX SECURITY ANNOUNCEMENT 200304-03
- - ---------------------------------------------------------------------

PACKAGE : setiathome
SUMMARY : buffer overflow
DATE : 2003-04-09 10:57 UTC
EXPLOIT : remote
VERSIONS AFFECTED : <3.08
FIXED VERSION : >=3.08
CVE :

- - ---------------------------------------------------------------------

- From advisory:

"There is a bufferoverflow in the server responds handler. Sending an
overly large string followed by a newline ('n') character to the
client will trigger this overflow. This has been tested with various
versions of the client. All versions are presumed to have this flaw in
some form."

Read the full advisory at:
http://spoor12.edup.tudelft.nl/

SOLUTION

It is recommended that all Gentoo Linux users who are running
app-sci/setiathome upgrade to setiathome-3.08 as follows:

emerge sync
emerge setiathome
emerge clean

- - ---------------------------------------------------------------------
[email protected] - GnuPG key is available at http://cvs.gentoo.org/~aliz
- - ---------------------------------------------------------------------
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQE+k/y4fT7nyhUpoZMRAgi7AJ4hG59plYUfRAafSKbRmeI++rT5ZACgs+Vk
6Pqp0YFy+4mqb7Am7f4h/PQ=
=IlMz
-----END PGP SIGNATURE-----


Newsletter signup

Signup to our monthly newsletter and stay in touch with IT news!

Free E-books

We've got ebooks! But they're not online. :( Please give us a few days to bring downloads back.

Contact

Have something to say or just wanna drop us a line? Please keep this in mind: to spam, we reply with spam.

Contact us »