Bug 336101 (CVE-2007-4136) - CVE-2007-4136 ricci is vulnerable to a connect DoS attack
Summary: CVE-2007-4136 ricci is vulnerable to a connect DoS attack
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2007-4136
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 253783 253784
Blocks:
TreeView+ depends on / blocked
 
Reported: 2007-10-17 13:12 UTC by Mark J. Cox
Modified: 2019-09-29 12:21 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2008-01-11 17:21:31 UTC


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2007:0640 normal SHIPPED_LIVE Moderate: conga security, bug fix, and enhancement update 2007-11-08 14:19:24 UTC
Red Hat Product Errata RHSA-2007:0983 normal SHIPPED_LIVE Moderate: conga security, bug fix, and enhancement update 2007-11-29 17:36:39 UTC

Description Mark J. Cox 2007-10-17 13:12:16 UTC
The ricci daemon will accept a maximum of 10 active connections. If the
connection limit is reached, new connections will be dropped. ricci only updates
its connection count (after freeing all stale connections) when poll(2) returns
0. If an attacker fills the connection queue, and either keeps sending data or
keeps connecting (or does anything else that'd cause poll() to return non-zero),
ricci will be unable to accept new connections.

This was found during a code audit chasing down a memory leak bug..

initial triage, assigning CVE name and metadata
CVSS medium 4.7 (AV:A/AC:L/Au:N/C:P/I:N/A:N)

Comment 2 Mark J. Cox 2007-10-31 12:29:46 UTC
removing embargo

Comment 3 Red Hat Product Security 2008-01-11 17:21:31 UTC
This issue was addressed in:

Red Hat Cluster Suite:
  http://rhn.redhat.com/errata/RHSA-2007-0983.html

Red Hat Enterprise Linux:
  http://rhn.redhat.com/errata/RHSA-2007-0640.html


Note You need to log in before you can comment on or make changes to this bug.