OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: Spybreak (spybreakhost.sk)
Date: Fri May 24 2002 - 03:39:23 CDT

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

    Release : May 24, 2002
    Author : Spybreak (spybreakhost.sk)
    Software : netstd
    Version : 3.07-17
    URL : debian.org
    Status : vendor contacted
    Problem : Multiple remote buffer overflows

    --- Intro ---

    Netstd is a package of networking utilities and daemons
    from the Debian Linux distribution.

    --- Problem ---

    It is possible to remotely overflow buffers in several utilities
    from the package, through owned DNS server.
    The FQDN obtained from the reply is simply copied into small fixed
    size buffer, without any check on the length of the answer.

    The same problem is present in these utils from the netstd 3.07-17
    package:

    - linux-ftpd
    - pcnfsd
    - tftp
    - traceroute
    - from/to

    Public key:
    http://spybreak.host.sk