TITLE: fprobe Weak Hash Functions Denial of Service SECUNIA ADVISORY ID: SA14072 VERIFY ADVISORY: http://secunia.com/advisories/14072/ CRITICAL: Less critical IMPACT: DoS WHERE: >From local network SOFTWARE: fprobe 1.x http://secunia.com/product/3947/ DESCRIPTION: A vulnerability has been reported in fprobe, which potentially can be exploited by malicious people to cause a DoS (Denial of Service). The vulnerability is caused due to weak hash implementations for the xor8, xor16, and crc16 hash functions. This may be exploited to cause a vulnerable service to consume a large amount of CPU resources by sending some specially crafted data generating a large amount of hash collisions. SOLUTION: Update to version 1.1. http://sourceforge.net/project/showfiles.php?group_id=63535 PROVIDED AND/OR DISCOVERED BY: Reported by vendor.
squinky86, please bump to version 1.1
netmon herd : squinky86 is MIA, please bump to 1.1.
I'll get on it asap.
1.1 stable on x86; vulnerable version removed. No other archs were previously stable.
Thanks Aaron. Security, please vote on GLSA. Local DoS... I vote no.
It's a remote DoS (local network) by CPU consumption, not a purely local one.
... but I vote NO too. Reopen if you disagree.
