Date: Sat, 19 Apr 2014 12:51:04 +1200 From: Matthew Daley <mattd@...fuzz.com> To: oss-security@...ts.openwall.com Subject: CVE request / advisory: gdomap (GNUstep core package <= 1.24.6) Hi, I'd like to request a CVE ID for this issue. It was found in software from GNUstep (www.gnustep.org), which develop an open-source development framework and runtime for client and server applications. This is the first such request and the issue is (now) public; this message serves as an advisory as well. Affected software: gdomap (GNUstep Distributed Objects nameserver) Description: After receiving a crafted invalid request, gdomap will attempt to log an error message to the system logger. However, due to incorrect setup of the logger during server initialization, the logger and gdomap itself will mess up program state enough that program execution will be aborted. gdomap listens to all interfaces, allowing a remote unauthenticated attacker to DOS the nameserver. (Please see the bug tracker entry for more detailed information.) Bug tracker: https://savannah.gnu.org/bugs/?41751 Affected versions: current releases (GNUstep core package <= 1.24.6) Fix: http://svn.gna.org/viewcvs/gnustep/libs/base/trunk/Tools/gdomap.c?r1=37756&r2=37755&pathrev=37756 Release notes: http://svn.gna.org/viewcvs/gnustep/libs/base/trunk/ChangeLog?r1=37756&r2=37755&pathrev=37756 Reported by: Matthew Daley Please let me know if you need any further information. Thanks, - Matthew Daley
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.