Bug 166013 – net-misc/dibbler < 0.6.1: Multiple Denial of Service Vulnerabilities (CVE-2007-50{28,29,30,31})

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Petr Pisar 2007-02-08 22:49:02 UTC]

0.6.0_rc1 has been released by the developers. Ebuild follows.

Reproducible: Always

Steps to Reproduce:

[Comment 1 Petr Pisar 2007-02-08 22:54:18 UTC]

Created attachment 109595 [details, diff]
dibbler-0.6.0_rc1.ebuild

Diff betwean 0.4.1 and 0.6.0_rc1.

${FILESDIR}/${PN}-gcc-4.1.patch is not necessary anymore.

[Comment 2 Tiziano Müller (RETIRED) 2007-07-16 16:04:18 UTC]

Final version 0.6.0 is available

[Comment 3 Petr Pisar 2007-09-20 11:03:00 UTC]

Created attachment 131358 [details, diff]
dibbler-0.6.1.ebuild

Version 0.6.1 has been released. This is corresponding ebuild.

[Comment 4 Tobias Heinlein (RETIRED) 2007-09-20 20:35:55 UTC]

Mu Security research team has reported some vulnerabilities in
Dibbler, which can be exploited by malicious people to cause a DoS
(Denial of Service).

The vulnerabilities are caused due to input validation errors when
processing packets and can be exploited to crash the service via
specially crafted packets with e.g. options with large lengths,
invalid lengths, or malformed IA_NA options in a REBIND message.

The vulnerabilities are reported in version 0.6.0. Prior versions may
also be affected.

Solution:
Update to version 0.6.1.

[Comment 5 Robert Buchholz (RETIRED) 2007-09-21 20:22:53 UTC]

The Secunia advisory quoted above is here:
http://secunia.com/advisories/26876/

CVE assigned the following names to these issues:
* CVE-2007-5028 
  Dibbler 0.6.0 on Linux uses weak world-writable permissions for
  unspecified files in /var/lib/dibbler, which has unknown impact and
  local attack vectors.

* CVE-2007-5029
  Dibbler 0.6.0 does not verify that certain length parameters are
  appropriate for buffer sizes, which allows remote attackers to
  trigger a buffer over-read and cause a denial of service (daemon
  crash), as demonstrated by incorrect behavior of the TSrvMsg
  constructor in SrvMessages/SrvMsg.cpp when (1) reading the option
  code and option length and (2) parsing options.

* CVE-2007-5030
  Multiple integer overflows in Dibbler 0.6.0 allow remote attackers
  to cause a denial of service (daemon crash) via packets containing
  options with large lengths, which trigger attempts at excessive
  memory allocation, as demonstrated by (1) the TSrvMsg constructor in
  SrvMessages/SrvMsg.cpp; the (2) TClntMsg, (3) TClntOptIAAddress, (4)
  TClntOptIAPrefix, (5) TOptVendorSpecInfo, and (6) TOptOptionRequest
  constructors; and the (7) TRelIfaceMgr::decodeRelayRepl, (8)
  TRelMsg::decodeOpts, and (9) TSrvIfaceMgr::decodeRelayForw methods.

* CVE-2007-5031
  The TSrvOptIA_NA::rebind method in SrvOptions/SrvOptIA_NA.cpp in
  Dibbler 0.6.0 allows remote attackers to cause a denial of service
  (NULL dereference and daemon crash) via an invalid IA_NA option in a
  REBIND message.

[Comment 6 Pierre-Yves Rofes (RETIRED) 2007-09-24 18:05:19 UTC]

gmsoft, please bump as necessary.

[Comment 7 Guy Martin (RETIRED) 2007-09-26 12:58:39 UTC]

I bumped to 0.6.1.
Sorry for delay.

[Comment 8 Pierre-Yves Rofes (RETIRED) 2007-09-26 13:04:08 UTC]

thanks. closing without glsa.