oss-sec mailing list archives
CVE request / advisory: gdomap (GNUstep core package <= 1.24.6)
From: Matthew Daley <mattd () bugfuzz com>
Date: Sat, 19 Apr 2014 12:51:04 +1200
Hi, I'd like to request a CVE ID for this issue. It was found in software from GNUstep (www.gnustep.org), which develop an open-source development framework and runtime for client and server applications. This is the first such request and the issue is (now) public; this message serves as an advisory as well. Affected software: gdomap (GNUstep Distributed Objects nameserver) Description: After receiving a crafted invalid request, gdomap will attempt to log an error message to the system logger. However, due to incorrect setup of the logger during server initialization, the logger and gdomap itself will mess up program state enough that program execution will be aborted. gdomap listens to all interfaces, allowing a remote unauthenticated attacker to DOS the nameserver. (Please see the bug tracker entry for more detailed information.) Bug tracker: https://savannah.gnu.org/bugs/?41751 Affected versions: current releases (GNUstep core package <= 1.24.6) Fix: http://svn.gna.org/viewcvs/gnustep/libs/base/trunk/Tools/gdomap.c?r1=37756&r2=37755&pathrev=37756 Release notes: http://svn.gna.org/viewcvs/gnustep/libs/base/trunk/ChangeLog?r1=37756&r2=37755&pathrev=37756 Reported by: Matthew Daley Please let me know if you need any further information. Thanks, - Matthew Daley
Current thread:
- CVE request / advisory: gdomap (GNUstep core package <= 1.24.6) Matthew Daley (Apr 18)
- Re: CVE request / advisory: gdomap (GNUstep core package <= 1.24.6) cve-assign (Apr 21)