Bug 453731 (CVE-2008-2953)

Summary:	linuxdcpp: multiple remote DoS issues (CVE-2008-2953, CVE-2008-2954)
Product:	[Other] Security Response	Reporter:	Tomas Hoger <thoger>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED CURRENTRELEASE	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	mgarski
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	1.0.1-3.fc9	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2008-07-26 06:08:01 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	453732, 453733, 453734
Bug Blocks:

Description Tomas Hoger 2008-07-02 08:54:20 UTC

Multiple remote DoS issue were reported for linuxdcpp:

http://www.openwall.com/lists/oss-security/2008/06/29/1

Linux DC++ (linuxdcpp) is a Direct Connect client based on the same 
client code as DC++, so it is vulnerable to the recently reported

[1] NULL pointer dereference remote DoS via partial file list requests
http://secunia.com/advisories/30812/
http://sourceforge.net/project/shownotes.php?release_id=608612&group_id=40287
https://bugs.launchpad.net/dcplusplus/+bug/238333 [restricted]

Patch for linuxdcpp:
http://cvs.berlios.de/cgi-bin/viewcvs.cgi/linuxdcpp/linuxdcpp/client/ShareManager.cpp.diff?r1=1.14&r2=1.15

[2] Empty message Remote DoS
When an attacker sends an empty message, he can cause the client to 
abort with "std::out_of_range" in substr().

Patch for linuxdcpp:
http://cvs.berlios.de/cgi-bin/viewcvs.cgi/linuxdcpp/linuxdcpp/client/NmdcHub.cpp.diff?r1=1.14&r2=1.15

Comment 1 Tomas Hoger 2008-07-02 09:01:01 UTC

CVE descriptions, currently bit messed with respect to version numbering
differences between (Windows) DC++ and Linux DC++, see oss-security thread.

CVE-2008-2953:
Linux DC++ (linuxdcpp) before 0.707 allows remote attackers to cause a
denial of service (crash) via "partial file list requests" that
trigger a NULL pointer dereference.

CVE-2008-2954:
client/NmdcHub.cpp in Linux DC++ (linuxdcpp) before 0.707 allows
remote attackers to cause a denial of service (crash) via an empty
private message, which triggers an out-of-bounds read.

Comment 3 Fedora Update System 2008-07-02 12:05:55 UTC

linuxdcpp-1.0.1-2.fc8 has been submitted as an update for Fedora 8

Comment 4 Fedora Update System 2008-07-02 12:06:57 UTC

linuxdcpp-1.0.1-3.fc9 has been submitted as an update for Fedora 9

Comment 5 Fedora Update System 2008-07-03 03:13:53 UTC

linuxdcpp-1.0.1-3.fc9 has been pushed to the Fedora 9 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 6 Fedora Update System 2008-07-03 03:16:00 UTC

linuxdcpp-1.0.1-2.fc8 has been pushed to the Fedora 8 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 7 Fedora Update System 2008-07-26 06:07:53 UTC

linuxdcpp-1.0.1-3.fc9 has been pushed to the Fedora 9 stable repository.  If problems still persist, please make note of it in this bug report.