Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 70516 - net-misc/pavuk: Multiple buffer overflows
Summary: net-misc/pavuk: Multiple buffer overflows
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All All
: High normal (vote)
Assignee: Gentoo Security
URL:
Whiteboard: C1 [glsa] lewk
Keywords:
Depends on:
Blocks:
 
Reported: 2004-11-08 15:42 UTC by Luke Macken (RETIRED)
Modified: 2004-11-10 14:47 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Luke Macken (RETIRED) gentoo-dev 2004-11-08 15:42:23 UTC
TITLE:
Pavuk Multiple Buffer Overflow Vulnerabilities

SECUNIA ADVISORY ID:
SA13120

VERIFY ADVISORY:
http://secunia.com/advisories/13120/

CRITICAL:
Highly critical

IMPACT:
System access

WHERE:
From remote

SOFTWARE:
Pavuk 0.x
http://secunia.com/product/3633/

DESCRIPTION:
Multiple vulnerabilities have been reported in Pavuk, which can be
exploited by malicious people to compromise a vulnerable system.

1) Some boundary errors within the digest authentication handler can
be exploited via malicious digest authentication challenges with
specially crafted nonce or realm values.

For more information:
SA12152

2) A boundary error within the processing HTTP header information can
be exploited to cause a stack-based buffer overflow.

For more information:
SA11975

3) Some other unspecified boundary errors can be exploited to cause
buffer overflows.

SOLUTION:
Update to version 0.9.31.
http://sourceforge.net/project/showfiles.php?group_id=81012

PROVIDED AND/OR DISCOVERED BY:
1) Matthew Murphy
2) Ulf Harnhammar
3) Reported by vendor

OTHER REFERENCES:
SA12152:
http://secunia.com/advisories/12152/

SA11975:
http://secunia.com/advisories/11975/
Comment 1 Luke Macken (RETIRED) gentoo-dev 2004-11-08 15:45:09 UTC
Daniel,

please bump to 0.9.31, thanks!
Comment 2 Daniel Drake (RETIRED) gentoo-dev 2004-11-09 02:24:01 UTC
Working on it..didn't even realise there were newer versions available on the sourceforge project page!
Comment 3 Daniel Drake (RETIRED) gentoo-dev 2004-11-09 12:14:35 UTC
0.9.31 in portage. Sorry it took so long, it wouldn't compile with gtk support. I spent a while trying to fix it so that it would compile, but after that its definately not working properly. Disabled this for now.

Should I mark the new ebuild stable?
Comment 4 Sune Kloppenborg Jeppesen gentoo-dev 2004-11-09 12:30:09 UTC
sparc please mark pavuk-0.9.31 stable.
Comment 5 Jason Wever (RETIRED) gentoo-dev 2004-11-09 19:56:45 UTC
Stable on sparc.
Comment 6 Thierry Carrez (RETIRED) gentoo-dev 2004-11-10 02:29:36 UTC
Looks like ppc wasn't called to mark stable...

ppc, please mark 0.9.31 stable
Comment 7 Jochen Maes (RETIRED) gentoo-dev 2004-11-10 02:43:50 UTC
stable on ppc
Comment 8 Luke Macken (RETIRED) gentoo-dev 2004-11-10 14:47:07 UTC
GLSA 200411-19