Skip to Content.
Sympa Menu

sm-security - [SM-Security] [SMGLSA-2006-28] centericq: ktools buffer overflow

sm-security AT lists.ibiblio.org

Subject: Security bugs are reported here via bugzilla

List archive

Chronological Thread  
  • From: George sherwood <pilot AT beernabeer.com>
  • To: sm-security AT lists.ibiblio.org
  • Subject: [SM-Security] [SMGLSA-2006-28] centericq: ktools buffer overflow
  • Date: Sat, 3 Jun 2006 18:20:12 -0400

1. Synopsis
============
Stack-based buffer overflow in kkstrtext.h in ktools library
0.3 and earlier, as used in products such as (1) centericq, (2)
orpheus, (3) motor, and (4) groan., allows local users or remote
attackers to execute arbitrary code via a long parameter to the
VGETSTRING macro.

2. Background
=============
centericq uses ktools version 0.1 and this could allow this Stack-based
buffer overflow.

3. Description
============
CVE-2005-3863

Stack-based buffer overflow in kkstrtext.h in ktools library 0.3 and earlier,
as used in products such as (1) centericq, (2) orpheus, (3) motor, and (4)
groan, allows local users or remote attackers to execute arbitrary code via a
long parameter to the VGETSTRING macro.
References

* BUGTRAQ:20051127 ZRCSA-200503 - ktools Buffer
Overflow Vulnerability *

URL:http://www.securityfocus.com/archive/1/archive/1/417906/100/0/threaded
* MISC:http://www.zone-h.org/en/advisories/read/id=8480/
* GENTOO:GLSA-200512-11
* URL:http://security.gentoo.org/glsa/glsa-200512-11.xml
* BID:15600
* URL:http://www.securityfocus.com/bid/15600
* FRSIRT:ADV-2005-2605
* URL:http://www.frsirt.com/english/advisories/2005/2605
* OSVDB:21161
* URL:http://www.osvdb.org/21161
* SECUNIA:17768
* URL:http://secunia.com/advisories/17768
* SECUNIA:18081
* URL:http://secunia.com/advisories/18081
* XF:ktools-kkstrtext-bo(23233)
* URL:http://xforce.iss.net/xforce/xfdb/23233

4. Impact
========
Allows local users or remote
attackers to execute arbitrary code via a long parameter to the
VGETSTRING macro.

5. Workaround
=========
There are no known workarounds at this time.

6. Affected Packages
=========
Centericq versions 4.21.0 and earlier using ktools version <0.3

7. Resolution
=========
Update centericq as soon as possible
All centericq users should upgrade to the latest available version:
# scribe update
# cast -c centericq

or

# scribe update
# sorcery queue-security
# cast --queue

8. References
===========
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3863

--
George Sherwood
Source Mage GNU/Linux developer
http://www.sourcemage.org

Attachment: signature.asc
Description: PGP signature



  • [SM-Security] [SMGLSA-2006-28] centericq: ktools buffer overflow, George sherwood, 06/03/2006

Archive powered by MHonArc 2.6.24.

Top of Page