"Fossies" - the Fresh Open Source Software Archive

Member "leafnode-1.12.0/leafnode-SA-2005-02.txt" (30 Jan 2009, 3068 Bytes) of package /linux/misc/leafnode-1.12.0.tar.xz:

As a special service "Fossies" has tried to format the requested text file into HTML format (style: standard) with prefixed line numbers. Alternatively you can here view or download the uninterpreted source code file. 
    1 leafnode-SA-2005:02.fetchnews-hangs-on-header
    2 
    3 Topic:		potential denial of service in leafnode
    4 
    5 Announcement:	leafnode-SA-2005:02
    6 Author:		Matthias Andree
    7 Version:	1.00
    8 Announced:	2005-06-08
    9 Category:	main
   10 Type:		potential denial of service
   11 Impact:		fetchnews hangs, no new fetchnews/texpire processes
   12 		can be started
   13 Credits:	Adam Funk (bug report)
   14 Danger:		medium:
   15 		- no build-up of memory consumption
   16 		- no privilege escalation through this bug
   17 		- malicious upstream server can be unlisted
   18 CVE Name:	CVE-2005-1911
   19 URL:		http://www.leafnode.org/leafnode-SA-2005-02.txt
   20 		http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1911
   21 
   22 Affects:	leafnode versions up to and including 1.11.2
   23 
   24 Not affected:	leafnode 1.11.3
   25 
   26 Default install: affected.
   27 
   28 Corrected:	2005-06-08 14:06 UTC (CVS) - committed corrected version
   29 		2005-06-08                   leafnode 1.11.3 released
   30 
   31 0. Release history
   32 
   33 2005-06-08	1.00 initial announcement
   34 
   35 1. Background
   36 
   37 leafnode is a store-and-forward proxy for Usenet news, is uses the
   38 network news transfer protocol (NNTP). It consists of several
   39 collaborating programs, the server part is usually started by inetd,
   40 xinetd or tcpserver, the client part is usually started by cron,
   41 a PPP post-connect script or manually.
   42 
   43 This security announcement pertains to leafnode-1, the stable branch.
   44 
   45 The leafnode-2 development branch is not subject to security announcements.
   46 
   47 2. Problem description
   48 
   49 A vulnerability was found in the fetchnews program (the NNTP client) that
   50 may under some circumstances cause a wait for input that never arrives,
   51 fetchnews "hangs". This hang does not cost CPU.
   52 
   53 3. Impact
   54 
   55 As only one fetchnews program can run at a time, subsequently started
   56 fetchnews and texpire programs will terminate. This means that the news
   57 database will no longer be updated, older articles will no longer
   58 expire, until the hanging fetchnews process gets unstuck, usually
   59 through a manual "kill" command or a reboot.
   60 
   61 4. Workaround
   62 
   63 Comment out all configuration pertaining to the malicious server.
   64 
   65 Note that this is not a full solution as transient network errors can
   66 also cause delays in querying other network servers, and it requires
   67 manual intervention to find out which server is malicious.
   68 
   69 5. Solution
   70 
   71 Upgrade your leafnode package to version 1.11.3.
   72 leafnode 1.11.3 is available from SourceForge:
   73 <http://sourceforge.net/project/showfiles.php?group_id=57767>
   74 
   75 Leafnode 1.X versions are deemed stable, and it is usually best to go
   76 for the latest released 1.X version to have all the other bug fixes as
   77 well.
   78 
   79 A. References
   80 
   81 leafnode home page: <http://www.leafnode.org/>
   82 
   83 B. Copyright and License
   84 
   85 (C) Copyright 2005 by Matthias Andree, <matthias.andree@gmx.de>.
   86 Some rights reserved.
   87 
   88 This work is licensed under the Creative Commons
   89 Attribution-NonCommercial-NoDerivs German License. To view a copy of
   90 this license, visit http://creativecommons.org/licenses/by-nc-nd/2.0/de/
   91 or send a letter to Creative Commons; 559 Nathan Abbott Way;
   92 Stanford, California 94305; USA.
   93 
   94 END OF leafnode-SA-2005:02.fetchnews-hangs-on-header