PT-2004-1113 · Cfengine · Cfengine

Juan Pablo Martinez Kuhn · Publicado 2004-08-09 · Atualizado 2017-07-11 · CVE-2004-1702

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cfengine versions 2.0.0 through 2.1.7p1

Description The issue is related to the AuthenticationDialogue function in cfservd, which does not properly check the return value of the ReceiveTransaction function. This leads to a failed malloc call and triggers a null dereference, allowing remote attackers to cause a denial of service (crash). Additionally, there are multiple vulnerabilities in the cfengine package that can lead to violations of confidentiality, integrity, and availability of protected information, and these can be exploited remotely.

Recommendations For Cfengine versions 2.0.0 through 2.1.7p1, consider disabling the AuthenticationDialogue function as a temporary workaround until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

BDU:2015-09467

CVE-2004-1702

Produtos afetados

Cfengine

Referências · 8

• 🔥 http://coresecurity.com/common/showdoc.php?idx=387&idxseccion=10 · Exploit
• 🔥 http://security.gentoo.org/glsa/glsa-200408-08.xml · Exploit
• http://securityfocus.com/bid/10900 · Aviso do Fabricante
• http://secunia.com/advisories/12251 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2004-1702 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16937 · Nota
• https://bdu.fstec.ru/vul/2015-09467 · Nota de Segurança
• http://marc.info/?l=bugtraq&m=109208394910086&w=2 · Nota