Vasiliy Kulikov reported [1] that libnet6 did not check the basic_server::id_counter for integer overflows. This number is used to distinguish different users, so an attacker that was able to open UINT_MAX successive connections could get an identifier of an already existing connection, allowing them to hijack that user's connection. Note that, as reported, on i686 uint is a 32 bit counter, so an attacker would need to open 4,000,000,000 connections in order to complete the attack. This has been corrected in git [2]. [1] http://www.openwall.com/lists/oss-security/2011/10/30/3 [2] http://git.0x539.de/?p=net6.git;a=commitdiff;h=ac61d7fb42a1f977fb527e024bede319c4a9e169;hp=08c8e2261604c6fcbbaf62f9ae9d13f7015fcb9a
Created net6 tracking bugs for this issue Affects: fedora-all [bug 750633] Affects: epel-all [bug 750634]
net6-1.3.14-1.fc16 has been pushed to the Fedora 16 stable repository. If problems still persist, please make note of it in this bug report.
net6-1.3.14-1.el5 has been pushed to the Fedora EPEL 5 stable repository. If problems still persist, please make note of it in this bug report.
net6-1.3.14-1.el6 has been pushed to the Fedora EPEL 6 stable repository. If problems still persist, please make note of it in this bug report.
net6-1.3.14-1.fc14 has been pushed to the Fedora 14 stable repository. If problems still persist, please make note of it in this bug report.
net6-1.3.14-1.fc15 has been pushed to the Fedora 15 stable repository. If problems still persist, please make note of it in this bug report.