all versions of gmetad currently in portage are affected by a buffer overflow when handling requests through the interactive port (8652) and as shown in the linked URL. upstream is handling this problem through in : http://bugzilla.ganglia.info/cgi-bin/bugzilla/show_bug.cgi?id=223 including a proposed patch which will be backported to 3.1 and 3.0 for next release. Reproducible: Always Steps to Reproduce: 1. /etc/init.d/gmetad start 2. echo "/`python -c \"print \\"%s/%s\\" % ('a'*300,'b'*300)\"`" |nc localhost 8652 3. Actual Results: gmetad crashes with a corrupted stack which could be used (with a different payload) to execute code remotely. Expected Results: gmetad ignores the invalid request also tracked in RedHat's bugzilla in : https://bugzilla.redhat.com/show_bug.cgi?id=480236
The security team was quick on the uptake. Marking as a duplicate. Many thanks for letting us know though! *** This bug has been marked as a duplicate of bug 255366 ***
