GLSA 200311-03: HylaFAX: Remote code exploit in hylafax

http://security.gentoo.org/

Severity:	normal
Title:	HylaFAX: Remote code exploit in hylafax
Date:	11/10/2003
Bugs:	#33368
ID:	200311-03

Synopsis

A format bug condition allows a remote attacjer to execute arbitrary code as the root user.

Background

HylaFAX is a popular client-server fax package.

Affected packages

Package	Vulnerable	Unaffected	Architecture(s)
net-misc/hylafax	<= 4.1.7	>= 4.1.8	All supported architectures

Description

During a code review of the hfaxd server, the SuSE Security Team discovered a format bug condition that allows a remote attacker to execute arbitrary code as the root user. However, the bug cannot be triggered in the default hylafax configuration.

Impact

A remote attacker could execute arbitrary code with root privileges.

Workaround

There is no known workaround at this time.

Resolution

Users are encouraged to perform an 'emerge sync' and upgrade the package to the latest available version. Vulnerable versions of hylafax have been removed from portage. Specific steps to upgrade:

    # emerge sync
    # emerge -pv '>=net-misc/hylafax-4.1.8'
    # emerge '>=net-misc/hylafax-4.1.8'
    # emerge clean

References

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-200311-03.xml

Concerns?

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.