PT-2008-5105 · Neon · Neon

Joe Orton · Published 2008-08-27 · Updated 2024-06-15 · CVE-2008-3746

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions neon versions 0.28.0 through 0.28.2

Description The issue allows remote servers to cause a denial of service, resulting in a NULL pointer dereference and crash. This is related to Digest authentication, specifically the Digest domain parameter support, and the parse domain function.

Recommendations For versions 0.28.0 through 0.28.2, consider disabling Digest authentication as a temporary workaround until a patch is available. Restrict access to the parse domain function to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2008-3746

OPENSUSE-SU-2024:11080-1

Affected Products

Neon

References · 26

• http://secunia.com/advisories/31687 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2009:074 · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2008-October/msg00367.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2008-3746 · Vendor Advisory
• http://secunia.com/advisories/31508 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-3746 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:11080-1 · Vendor Advisory
• http://ubuntu.com/usn/usn-835-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2008-3746 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00006.html · Vendor Advisory
• http://lists.manyfish.co.uk/pipermail/neon/2008-August/000038.html · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-3746 · Vendor Advisory
• http://secunia.com/advisories/32286 · Vendor Advisory
• http://secunia.com/advisories/36799 · Vendor Advisory
• http://vupen.com/english/advisories/2008/2420 · Vendor Advisory