PT-2004-3665 · Neon · Libneon

Stefan Esser · Published 1970-01-01 · Updated 2020-10-09 · CVE-2004-0398

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions libneon versions 0.24.5 and earlier

Description The issue is related to a heap-based buffer overflow in the ne rfc1036 parse date parsing function of the neon library. This allows remote WebDAV servers to execute arbitrary code on the client. Multiple vulnerabilities in the libneon package can lead to disruption of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited remotely.

Recommendations For libneon versions 0.24.5 and earlier, update to a version later than 0.24.5 to resolve the issue. As a temporary workaround, consider restricting access to the ne rfc1036 parse function until a patch is available.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

BDU:2015-01965

BDU:2015-01966

CVE-2004-0398

DSA-506

DSA-507

Affected Products

Libneon

References · 27

• https://bdu.fstec.ru/vul/2015-01965 · Security Note
• http://debian.org/security/2004/dsa-506 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2004-191.html · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200405-15.xml · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0398 · Security Note
• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000841 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2004-0398 · Vendor Advisory
• https://bugzilla.fedora.us/show_bug.cgi?id=1552 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200405-13.xml · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2004-0398 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2004-0398 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-01966 · Security Note
• http://mandriva.com/security/advisories?name=MDKSA-2004:049 · Vendor Advisory
• http://debian.org/security/2004/dsa-507 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-0398 · Security Note