A portion of memory (random stack data) disclosure flaw was found in the way dtach, a simple program emulating the detach feature of screen, performed client connection termination under certain circumstances. A remote attacker could use this flaw to potentially obtain sensitive information by issuing a specially-crafted dtach client connection close request. Upstream ticket: [1] http://sourceforge.net/tracker/?func=detail&aid=3517812&group_id=36489&atid=417357 Preliminary proposed patch: [2] http://sourceforge.net/tracker/download.php?group_id=36489&atid=417357&file_id=441195&aid=3517812 References: [3] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=625302 [4] https://bugzilla.redhat.com/show_bug.cgi?id=812551
This issue affects the versions of the dtach package, as shipped with Red Hat Enterprise Linux 5 and 6. -- This issue affects the versions of the dtach package, as shipped with Fedora release of 16 and 17. Please schedule an update (once there is final upstream patch available).
CVE Request: [5] http://www.openwall.com/lists/oss-security/2012/06/27/3
Created attachment 594740 [details] Preliminary dtach patch, provided to SF upstream ticket
Created dtach tracking bugs for this issue Affects: fedora-all [bug 835853]
CVE-2012-3368 has been assigned to this issue, as per: http://www.openwall.com/lists/oss-security/2012/06/29/1
dtach-0.8-8.fc18 has been pushed to the Fedora 18 stable repository. If problems still persist, please make note of it in this bug report.
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2012-3368