Bug 50421

Summary:	net-www/pound-1.5 format string bugs
Product:	Gentoo Security	Reporter:	Nilanjan De <n2n>
Component:	GLSA Errors	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	major	CC:	web-apps
Priority:	High	Flags:	koon: Assigned_To? (koon)
Version:	unspecified
Hardware:	All
OS:	All
Whiteboard:
Package list:		Runtime testing required:	---

Description Nilanjan De 2004-05-07 17:41:36 UTC

http://www.securitytracker.com/alerts/2004/May/1010034.html


in addition pound 1.5 fails to stop on
/etc/init.d/pound stop

Workaround: Mark pound-1.6 or 1.7 stable

Comment 1 solar (RETIRED) gentoo-dev

2004-05-08 23:13:44 UTC

web-apps herd. Can you mark this version as stable?

Comment 2 Stuart Herbert (RETIRED) gentoo-dev

2004-05-09 03:36:22 UTC

I'm looking into it now for you.

Comment 3 Stuart Herbert (RETIRED) gentoo-dev

2004-05-09 12:58:56 UTC

Okay, I've marked pound-1.7 stable, and removed pound-1.5 and earlier from CVS too.

Do we have an exploit against pound-1.5 that we can test against pound-1.7?

Best regards,
Stu

Comment 4 Nilanjan De 2004-05-09 13:44:59 UTC

http://www.eos-india.net/poc/305-pound.c.txt

Comment 5 Thierry Carrez (RETIRED) gentoo-dev

2004-05-11 08:41:40 UTC

Ready for a GLSA

Comment 6 Thierry Carrez (RETIRED) gentoo-dev

2004-05-16 09:30:58 UTC

GLSA drafted

Comment 7 Thierry Carrez (RETIRED) gentoo-dev

2004-05-18 13:16:42 UTC

GLSA 200405-08