Home page logo

oss-sec logo oss-sec mailing list archives

CVE request / advisory: gdomap (GNUstep core package <= 1.24.6)
From: Matthew Daley <mattd () bugfuzz com>
Date: Sat, 19 Apr 2014 12:51:04 +1200


I'd like to request a CVE ID for this issue. It was found in software
from GNUstep (www.gnustep.org), which develop an open-source
development framework and runtime for client and server applications.

This is the first such request and the issue is (now) public; this
message serves as an advisory as well.

Affected software: gdomap (GNUstep Distributed Objects nameserver)
Description: After receiving a crafted invalid request, gdomap will
attempt to log an error message to the system logger. However, due to
incorrect setup of the logger during server initialization, the logger
and gdomap itself will mess up program state enough that program
execution will be aborted. gdomap listens to all interfaces, allowing
a remote unauthenticated attacker to DOS the nameserver. (Please see
the bug tracker entry for more detailed information.)
Bug tracker: https://savannah.gnu.org/bugs/?41751
Affected versions: current releases (GNUstep core package <= 1.24.6)
Fix: http://svn.gna.org/viewcvs/gnustep/libs/base/trunk/Tools/gdomap.c?r1=37756&r2=37755&pathrev=37756
Release notes: http://svn.gna.org/viewcvs/gnustep/libs/base/trunk/ChangeLog?r1=37756&r2=37755&pathrev=37756
Reported by: Matthew Daley

Please let me know if you need any further information.


- Matthew Daley

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]