PT-2014-2439 · Corosync · Corosync

Kurt Seifried · Published 2014-06-06 · Updated 2014-06-09 · CVE-2013-0250

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Corosync versions 2.0 through 2.3

Description The issue is related to the init nss hash function in exec/totemcrypto.c, which does not properly initialize the HMAC key. This allows remote attackers to cause a denial of service by sending a crafted packet, resulting in a crash.

Recommendations For Corosync versions 2.0 through 2.3, update to version 2.3 or later to resolve the issue.

Exploit

Fix

Related Identifiers

CVE-2013-0250

Affected Products

Corosync

References · 6

• 🔥 https://github.com/corosync/corosync/commit/b3f456a8ceefac6e9f2e9acc2ea0c159d412b595 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-0250 · Security Note
• http://seclists.org/oss-sec/2013/q1/214 · Note
• http://seclists.org/oss-sec/2013/q1/213 · Note
• http://seclists.org/oss-sec/2013/q1/212 · Note
• http://secunia.com/advisories/52037 · Note