Red Hat Bugzilla – Bug 835849
CVE-2012-3368 dtach: Memory portion (random stack data) disclosure to the client by unclean client disconnect
Last modified: 2016-11-08 11:04:58 EST
A portion of memory (random stack data) disclosure flaw was found in the way dtach, a simple program emulating the detach feature of screen, performed client connection termination under certain circumstances. A remote attacker could use this flaw to potentially obtain sensitive information by issuing a specially-crafted dtach client connection close request. Upstream ticket: [1] http://sourceforge.net/tracker/?func=detail&aid=3517812&group_id=36489&atid=417357 Preliminary proposed patch: [2] http://sourceforge.net/tracker/download.php?group_id=36489&atid=417357&file_id=441195&aid=3517812 References: [3] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=625302 [4] https://bugzilla.redhat.com/show_bug.cgi?id=812551
This issue affects the versions of the dtach package, as shipped with Red Hat Enterprise Linux 5 and 6. -- This issue affects the versions of the dtach package, as shipped with Fedora release of 16 and 17. Please schedule an update (once there is final upstream patch available).
CVE Request: [5] http://www.openwall.com/lists/oss-security/2012/06/27/3
Created attachment 594740 [details] Preliminary dtach patch, provided to SF upstream ticket
Created dtach tracking bugs for this issue Affects: fedora-all [bug 835853]
CVE-2012-3368 has been assigned to this issue, as per: http://www.openwall.com/lists/oss-security/2012/06/29/1
Statement: This issue affects the version of dtach as shipped with Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this issue as having low security impact, a future update may address this flaw.
dtach-0.8-8.fc18 has been pushed to the Fedora 18 stable repository. If problems still persist, please make note of it in this bug report.