neon NULL Pointer Dereference in parse_domain() Lets Remote Servers Deny Service
|
|
SecurityTracker Alert ID: 1020725
|
|
SecurityTracker URL: http://securitytracker.com/id?1020725
|
|
CVE Reference: CVE-2008-3746
(Links to External Site)
|
Date: Aug 21 2008
|
Impact: Denial of service via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Version(s): 0.28.0, 0.28.1, and 0.28.2
|
Description: A vulnerability was reported in neon. A remote user can cause denial of service conditions.
A remote server can return a specially crafted Digest domain parameter response to the connected target client to trigger a NULL
pointer dereference and cause the target client to crash.
The vulnerability resides in 'ne_auth.c'.
Yves-Alexis Perez reported
this vulnerability.
|
Impact: A remote server can cause denial of service conditions on the connected target client.
|
Solution: The vendor has issued a fixed version (0.28.3), available at:
http://www.webdav.org/neon/neon-0.28.3.tar.gz
|
Vendor URL: www.webdav.org/neon/ (Links to External Site)
|
Cause: Access control error
|
Underlying OS: Linux (Any), UNIX (Any)
|
Reported By: Joe Orton <joe@manyfish.co.uk>
|
Message History:
None.
|
Source Message Contents
|
Date: Wed Aug 20 15:49:59 EDT 2008
From: Joe Orton <joe@manyfish.co.uk>
Subject: neon: release 0.28.3 (SECURITY)
|
Download: http://www.webdav.org/neon/neon-0.28.3.tar.gz
Signature: http://www.webdav.org/neon/neon-0.28.3.tar.gz.asc
MD5: 47599a328862ce64ac3c52726d6daa12 neon-0.28.3.tar.gz
SHA1: 544a92dbfba144ec600506cadbda92ae0b0eb9b0 neon-0.28.3.tar.gz
Changes in release 0.28.3:
* SECURITY (CVE-2008-3746): Fix potential NULL pointer dereference in
Digest domain parameter support; could allow a DoS by a malicious server
* Fix parsing of *-Authenticate response header with LWS after quoted value
* Fix ne_set_progress(, NULL, ) to match pre-0.27 behaviour (and not crash)
* Fix to disable Nagle on Win32 with newer toolchain (thanks to Stefan Küng)
* Fix build on Netware (Guenter Knauf)
* Document existing ne_uri_parse() API postcondition and ne_uri_resolve()
pre/postconditions regarding the ->path field in ne_uri structures
* Mark ne_{,buffer_}concat with sentinel attribute for GCC >= 4.
* Distinguish the error message for an SSL handshake which fails after a
client cert was requested.
* Compile with PIC flags by default even for static library builds
|
|
