261506 – <app-forensics/samhain-2.5.4 SRP Authentication Bypass Vulnerability

Bug 261506 - <app-forensics/samhain-2.5.4 SRP Authentication Bypass Vulnerability

Summary: <app-forensics/samhain-2.5.4 SRP Authentication Bypass Vulnerability

Status:	RESOLVED FIXED

Alias:	None

Product:	Gentoo Security
Classification:	Unclassified
Component:	Vulnerabilities (show other bugs)
Hardware:	All Linux

Importance:	High trivial (vote)
Assignee:	Gentoo Security

URL:	http://secunia.com/advisories/34104/
Whiteboard:	~3 [noglsa]
Keywords:

Depends on:
Blocks:

Reported:	2009-03-06 23:57 UTC by Robert Buchholz (RETIRED)
Modified:	2009-03-30 18:15 UTC (History)
CC List:	2 users (show)

See Also:
Package list:
Runtime testing required:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Robert Buchholz (RETIRED) gentoo-dev

2009-03-06 23:57:19 UTC

A vulnerability has been reported in Samhain, which can be exploited
by malicious people to bypass certain security restrictions.

The vulnerability is caused due to an input validation error in the
implementation of the SRP authentication protocol. This can be
exploited to bypass authentication on a Samhain server and e.g.
disclose potentially sensitive information.

The vulnerability is reported in Samhain server in versions prior
2.5.4.

SOLUTION:
Update to version 2.5.4.

PROVIDED AND/OR DISCOVERED BY:
The vendor credits Thomas Ptacek.

ORIGINAL ADVISORY:
http://trac.la-samhna.de/samhain/ticket/150

Comment 1 Patrick Lauer gentoo-dev

2009-03-29 09:27:53 UTC

*samhain-2.5.4 (29 Mar 2009)

  29 Mar 2009; Patrick Lauer <patrick@gentoo.org> +samhain-2.5.4.ebuild:
  Bump to 2.5.4, adding ~amd64 keywords. Needs more testing/cleanup. Needed
  for #261506

New version in the tree.

Comment 2 Robert Buchholz (RETIRED) gentoo-dev

2009-03-30 18:15:50 UTC

thanks, closing.