From: http://archives.neohapsis.com/archives/bugtraq/2006-04/att-0519/os2a_1005.txt -------------------------- Description: -------------- A buffer overflow vulnerability exists in the implementation of split() function in NASL. Impact: -------- This causes nasl to consume a large amount of CPU and memory resources and stop responding. Execution of arbitrary commands on the vulnerable host may be possible. To exploit this, an attacker need to have the ability to execute nasl scripts using the 'nasl' command. Affected Software(s): --------------------- Nessus 3.0.2 and prior Nessus 2.2.7 and prior (...) ----------------------- and from http://archives.neohapsis.com/archives/bugtraq/2006-04/0526.html : At the opposite of what the full advisory hints, this issue is NOT exploitable. (understand : not exploitable to execute arbitrary code, see http://archives.neohapsis.com/archives/bugtraq/2006-04/0524.html ) a patch is provided in http://archives.neohapsis.com/archives/bugtraq/2006-04/att-0519/os2a_1005.txt Could you please check the patch and then provide a patched ebuild.
I'd rather wait for an upstream release - it looks like Renaud Deraison is aware of the issue...
Setting to upstream until Renaud comes up with a fixed version
*** Bug 132352 has been marked as a duplicate of this bug. ***
Rereading, this one is really sucky. I would just RESOLVED/INVALIDate it.
I agree with Koon and closing as invalid. Feel free to reopen if you disagree.
OK :) jaervosz was just here a few minutes before me