Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 296334 - net-proxy/polipo: httpClientDiscardBody() Signedness Error Denial of Service
Summary: net-proxy/polipo: httpClientDiscardBody() Signedness Error Denial of Service
Status: RESOLVED DUPLICATE of bug 300173
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: High normal (vote)
Assignee: Gentoo Security
URL: http://www.exploit-db.com/exploits/10338
Whiteboard: B4 [ebuild]
Keywords:
Depends on: CVE-2009-3305
Blocks:
  Show dependency tree
 
Reported: 2009-12-09 18:13 UTC by Stefan Behte (RETIRED)
Modified: 2010-08-01 12:40 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Stefan Behte (RETIRED) gentoo-dev Security 2009-12-09 18:13:55 UTC 
Remote DOS is possible.

# polipo-20080907/client.c [1001-1009]:
#
#     if(connection->reqlen > connection->reqbegin) {
#         memmove(connection->reqbuf, connection->reqbuf + connection->reqbegin,
#                 connection->reqlen - connection->reqbegin);
#         connection->reqlen -= connection->reqbegin;
#         connection->reqbegin = 0;
#     } else {
#         connection->reqlen = 0;
#         connection->reqbegin = 0;
#     }
Comment 1 Tim Harder gentoo-dev 2010-04-11 09:55:35 UTC 
This appears to be fixed in polipo-1.0.4.1. See bug #300173 for simple ebuild updates from polipo-1.0.4 to 1.0.4.1.
Comment 2 Stefan Behte (RETIRED) gentoo-dev Security 2010-08-01 12:40:26 UTC 

*** This bug has been marked as a duplicate of bug 300173 ***