Logsurfer Double Free Memory Error in prepare_exec() Lets Local Users Deny Service

	Keep Track of the Latest Vulnerabilities with SecurityTracker!

SecurityTracker Alert ID: 1026198

SecurityTracker URL: http://securitytracker.com/id/1026198

CVE Reference: CVE-2011-3626 (Links to External Site)

Updated: Jan 20 2012

Original Entry Date: Oct 18 2011

Impact: Denial of service via local system

Fix Available: Yes Vendor Confirmed: Yes

Version(s): 1.5b and prior versions; 1.7

Description: A vulnerability was reported in Logsurfer. A local user can cause denial of service conditions.

A local user can trigger a double free memory error in prepare_exec() and cause the application to crash.

Gregor Kopf of Recurity Labs GmbH reported this vulnerability.

Impact: A local user can cause denial of service conditions on the target system.

Solution: The vendor has issued a fix, available at:

http://logsurfer.git.sourceforge.net/git/gitweb.cgi?p=logsurfer/logsurfer;a=commit;h=07983748da9ea3d4954b80f02fed692fe21b1134

Vendor URL: www.crypt.gen.nz/logsurfer/ (Links to External Site)

Cause: Access control error

Underlying OS: Linux (Any), UNIX (Any)

Message History: This archive entry has one or more follow-up message(s) listed below.

Date: Tue, 18 Oct 2011 04:38:19 +0000
Subject: LogSurfer


http://permalink.gmane.org/gmane.comp.security.oss.general/6022