614848 – (CVE-2017-7401) <app-admin/collectd-5.6.2-r2: Infinite loop due to incorrect interaction of parse_packet() and parse_part_sign_sha256() functions

Bug 614848 (CVE-2017-7401) - <app-admin/collectd-5.6.2-r2: Infinite loop due to incorrect interaction of parse_packet() and parse_part_sign_sha256() functions

Summary: <app-admin/collectd-5.6.2-r2: Infinite loop due to incorrect interaction of p...

Status:	RESOLVED FIXED

Alias:	CVE-2017-7401

Product:	Gentoo Security
Classification:	Unclassified
Component:	Vulnerabilities (show other bugs)
Hardware:	All Linux

Importance:	Normal minor (vote)
Assignee:	Gentoo Security

URL:	https://bugzilla.redhat.com/show_bug....
Whiteboard:	B3 [noglsa/cve]
Keywords:

Depends on:
Blocks:

Reported:	2017-04-06 15:14 UTC by Agostino Sarubbo
Modified:	2017-04-11 06:17 UTC (History)
CC List:	1 user (show)

See Also:
Package list:
Runtime testing required:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Agostino Sarubbo gentoo-dev

2017-04-06 15:14:57 UTC

From ${URL} :

Incorrect interaction of the parse_packet() and parse_part_sign_sha256() functions in network.c in collectd allows remote attackers to cause a denial of service (infinite loop) of a collectd instance 
(configured with "SecurityLevel None" and with empty "AuthFile" options) via a crafted UDP packet.

Upstream bug:

https://github.com/collectd/collectd/issues/2174


@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.

Comment 1 Thomas Deutschmann (RETIRED) gentoo-dev

2017-04-06 15:53:22 UTC

Fixed via https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=06fd84be0f99d0192caf0f4e4f5a713f85a49a7e

Maintainer stabilization via https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=e3c62ade04937c479cadc21cdc20878b71ad05b3

Security cleanup via https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=40cd8316a2dd6fb07907f2f1b38d5828444daefe


@ Security: Please proceed. I don't vote on my own packages.

Comment 2 Yury German Gentoo Infrastructure

2017-04-11 06:17:58 UTC

Maintainer(s), Thank you for your work.
GLSA Vote: No