blob: 5e0bfe6b3432d4f73e1ec475df802f816d852c00 [file] [log] [blame]
<?xml version="1.0" encoding="UTF-8"?>
<glsa id="200311-03">
<title>HylaFAX: Remote code exploit in hylafax</title>
A format bug condition allows a remote attacjer to execute arbitrary code as
the root user.
<product type="ebuild">HylaFAX</product>
<revised>2003-11-10: 01</revised>
<package name="net-misc/hylafax" auto="yes" arch="*">
<unaffected range="ge">4.1.8</unaffected>
<vulnerable range="le">4.1.7</vulnerable>
HylaFAX is a popular client-server fax package.
During a code review of the hfaxd server, the SuSE Security Team discovered
a format bug condition that allows a remote attacker to execute arbitrary
code as the root user. However, the bug cannot be triggered in the default
hylafax configuration.
<impact type="normal">
A remote attacker could execute arbitrary code with root privileges.
There is no known workaround at this time.
Users are encouraged to perform an 'emerge sync' and upgrade the package to
the latest available version. Vulnerable versions of hylafax have been
removed from portage. Specific steps to upgrade:
# emerge sync
# emerge -pv '&gt;=net-misc/hylafax-4.1.8'
# emerge '&gt;=net-misc/hylafax-4.1.8'
# emerge clean</code>
<uri link="">CAN-2003-0886</uri>
<uri link="">SuSE Security Announcment</uri>