66424 – distcc IP-based Access Control Rules Security Bypass (<2.16)

Bug 66424 - distcc IP-based Access Control Rules Security Bypass (<2.16)

Summary: distcc IP-based Access Control Rules Security Bypass (<2.16)

Status:	RESOLVED DUPLICATE of bug 64317

Alias:	None

Product:	Gentoo Security
Classification:	Unclassified
Component:	Vulnerabilities (show other bugs)
Hardware:	All Linux

Importance:	High normal (vote)
Assignee:	Gentoo Security

URL:	http://www.osvdb.org/10475
Whiteboard:
Keywords:

Depends on:
Blocks:

Reported:	2004-10-05 07:04 UTC by Marc Vila
Modified:	2011-10-30 22:40 UTC (History)
CC List:	1 user (show)

See Also:
Package list:
Runtime testing required:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Marc Vila 2004-10-05 07:04:56 UTC

distcc contains a flaw that may allow a malicious user to gain access to unauthorized privileges. The issue is triggered when an attempt to bypass IP access control on a 64 bit platform occurs. This flaw may lead to a loss of Confidentiality.
 
Vulnerability Classification: 
Remote/Network Access Required 
Authentication Attack 
Loss Of Confidentiality 
Exploit Unknown 
Verified 
 
Products: 
Martin Pool distcc 2.x 
 


Reproducible: Always
Steps to Reproduce:
1.
2.
3.




Solution: 
Upgrade to version 2.16 or higher, as it has been reported to fix this 
vulnerability. An upgrade is required as there are no known workarounds.

http://www.osvdb.org/10475

Comment 1 Luke Macken (RETIRED) gentoo-dev

2004-10-05 07:20:18 UTC

2.16 is already stable in portage

*** This bug has been marked as a duplicate of 64317 ***

Comment 2 Luke Macken (RETIRED) gentoo-dev

2004-10-05 07:26:57 UTC

Lisa,

All versions of distcc below 2.16 are vulnerable to this, do you think we should remove 2.14-r1 from portage?

Comment 3 Thierry Carrez (RETIRED) gentoo-dev

2004-10-05 07:45:15 UTC

Yes vulnerable versions should be removed from portage. No it's not necessary from a security point of view, nor is it required by policy. 

ReClosing this as a dupe. Further comments should go to the original bug.

*** This bug has been marked as a duplicate of 64317 ***