| Summary: |
net-proxy/polipo: httpClientDiscardBody() Signedness Error Denial of Service |
| Product: |
Gentoo Security
|
Reporter: |
Stefan Behte (RETIRED) <craig> |
| Component: |
Vulnerabilities | Assignee: |
Gentoo Security <security> |
| Status: |
RESOLVED
DUPLICATE
|
|
|
| Severity: |
normal
|
CC: |
net-proxy+disabled, radhermit
|
| Priority: |
High
|
|
|
| Version: |
unspecified | |
|
| Hardware: |
All | |
|
| OS: |
Linux | |
|
| URL: |
http://www.exploit-db.com/exploits/10338
|
| Whiteboard: |
B4 [ebuild] |
|
Package list:
|
|
Runtime testing required:
|
---
|
|---|
| Bug Depends on: |
300173
|
|
|
| Bug Blocks: |
|
|
|
Remote DOS is possible. # polipo-20080907/client.c [1001-1009]: # # if(connection->reqlen > connection->reqbegin) { # memmove(connection->reqbuf, connection->reqbuf + connection->reqbegin, # connection->reqlen - connection->reqbegin); # connection->reqlen -= connection->reqbegin; # connection->reqbegin = 0; # } else { # connection->reqlen = 0; # connection->reqbegin = 0; # }