File: leafnode-SA-2005-01.txt

package info (click to toggle)
leafnode 1.11.11-1
  • links: PTS
  • area: main
  • in suites: bullseye, buster, sid
  • size: 2,468 kB
  • sloc: ansic: 10,914; sh: 1,748; xml: 628; makefile: 291; perl: 84; sed: 4
file content (80 lines) | stat: -rw-r--r-- 2,519 bytes parent folder | download | duplicates (7)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
leafnode-SA-2005:01.fetchnews-crashes-on-timeout

Topic:		potential denial of service in leafnode

Announcement:	leafnode-SA-2005:01
Writer:		Matthias Andree
Version:	1.01
Announced:	2005-05-04
Category:	main
Type:		potential denial of service
Impact:		fetchnews crashes, some servers not queried
Danger:		low
		- malicious upstream server can easily be unlisted
CVE Name:	CVE-2005-1453
URL:		http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1453

Affects:	leafnode versions 1.9.48 to 1.11.1 inclusively

Not affected:	leafnode 1.11.2

Default install: affected.

Corrected:	2005-05-04 10:09 UTC (CVS) - committed corrected version
		2005-05-04                   leafnode 1.11.2 released

0. Release history

2005-05-04	1.00 initial announcement
2005-05-07	1.01 add CVE name and URL

1. Background

leafnode is a store-and-forward proxy for Usenet news, is uses the
network news transfer protocol (NNTP). It consists of several
collaborating programs, the server part is usually started by inetd,
xinetd or tcpserver, the client part is usually started by cron or
manually.

This security announcement pertains to leafnode-1, the stable branch.

The leafnode-2 development branch has not yet seen a stable release, so
it is not subject to security announcements.

2. Problem description

Two vulnerabilities were found in the fetchnews program (the NNTP
client). These can cause the fetchnews program to crash when the
upstream server closes the connection while leafnode is receiving (1) an
article header, or (2) an article body.

3. Impact

A malicious upstream server that purposefully drops the connection after
fetchnews has requested an article header or body can prevent fetchnews
from ever querying other servers that are listed after the malicious
server in the configuration file.

4. Workaround

Comment out all configuration pertaining to the malicious server.

Note that this is not a full solution as transient network errors can
also cause delays in querying other network servers, and it requires
manual intervention to find out which server is malicious.

5. Solution

Upgrade your leafnode package to version 1.11.2.
leafnode 1.11.2 is available from SourceForge:
<http://sourceforge.net/project/showfiles.php?group_id=57767>

Leafnode 1.X versions are deemed stable, and it is usually best to go
for the latest released 1.X version to have all the other bug fixes as
well.

A. References

leafnode home page: <http://www.leafnode.org/>

END OF leafnode-SA-2005:01.fetchnews-crashes-on-timeout