Bug 212700 (CVE-2006-5601)

Summary:	CVE-2006-5601: xsupplicant < 1.2.8 (?) stack smashing vulnerability
Product:	[Fedora] Fedora	Reporter:	Ville Skyttä <scop>
Component:	xsupplicant	Assignee:	Tom "spot" Callaway <tcallawa>
Status:	CLOSED RAWHIDE	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	high	Docs Contact:
Priority:	high
Version:	6	CC:	extras-qa, fedora-security-list, ondrejj
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
URL:	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2006-5601
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2006-11-21 16:03:38 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Ville Skyttä 2006-10-28 06:47:18 UTC

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2006-5601
http://open1x.sourceforge.net/

"7 Oct 2006 -- Xsupplicant 1.2.8 is now available for download. This release 
has several bug fixes in it, including a fix to a stack smash that could 
potentially lead to a remote root exploit."

Seems to affect all FE versions.

Comment 1 Ville Skyttä 2006-11-12 09:36:27 UTC

ping?

Comment 2 Jan ONDREJ 2006-11-21 09:25:38 UTC

It is not possible to connect with xsupplicant 1.2.7, but works fine with
version 1.2.8. Please can somebody rebuild this package? Thank you.

You can found a new (working) rpm package at:
  http://ftp.upjs.sk/pub/users/SAL/Fedora/SRPMS/6/xsupplicant-1.2.8-0.src.rpm

Release version is changed by me to automatically update after fedora extras
release.

Comment 3 Tom "spot" Callaway 2006-11-21 16:03:20 UTC

FE4, FE5, FE6 all bumped to 1.2.8. Thanks for the new SRPM Jan. :)