Bugtraq mailing list archives
GLSA: bitchx (200303-21)
From: Daniel Ahlberg <aliz () gentoo org>
Date: Mon, 24 Mar 2003 12:56:53 +0100
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - - --------------------------------------------------------------------- GENTOO LINUX SECURITY ANNOUNCEMENT 200303-21 - - --------------------------------------------------------------------- PACKAGE : bitchx SUMMARY : buffer overflow DATE : 2003-03-24 11:56 UTC EXPLOIT : remote VERSIONS AFFECTED : <1.0.19-r5 FIXED VERSION : >=1.0.19-r5 CVE : - - --------------------------------------------------------------------- - From advisory: "Full of sprintf() calls and relying on BIG_BUFFER_SIZE being large enough. There's multiple ways to exploit it by giving near-BIG_BUFFER_SIZE strings in various places." Read the full advisory at: http://marc.theaimsgroup.com/?l=bugtraq&m=104766521328322&w=2 SOLUTION It is recommended that all Gentoo Linux users who are running net-irc/bitchx upgrade to bitchx-1.0.19-r5 as follows: emerge sync emerge bitchx emerge clean - - --------------------------------------------------------------------- aliz () gentoo org - GnuPG key is available at http://cvs.gentoo.org/~aliz - - --------------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iD8DBQE+fvKBfT7nyhUpoZMRAuzlAKCOUEKFF4kgEMzoR764HVGxrjstQQCgqYyq t4OtjEq/D2dO+c6jFlBnPug= =Jz7V -----END PGP SIGNATURE-----
Current thread:
- GLSA: bitchx (200303-21) Daniel Ahlberg (Mar 24)