| <?xml version="1.0" encoding="utf-8"?> |
| <!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd"> |
| |
| <glsa id="200901-12"> |
| <title>noip-updater: Execution of arbitrary code</title> |
| <synopsis> |
| A buffer overflow in noip-updater can lead to arbitrary code execution. |
| </synopsis> |
| <product type="ebuild">noip-updater</product> |
| <announced>January 18, 2009</announced> |
| <revised>January 18, 2009: 01</revised> |
| <bug>248709</bug> |
| <access>remote</access> |
| <affected> |
| <package name="net-dns/noip-updater" auto="yes" arch="*"> |
| <unaffected range="ge">2.1.9</unaffected> |
| <vulnerable range="lt">2.1.9</vulnerable> |
| </package> |
| </affected> |
| <background> |
| <p> |
| noip-updater is a tool used for updating IP addresses of dynamic DNS |
| records at no-ip.com. |
| </p> |
| </background> |
| <description> |
| <p> |
| xenomuta found out that the GetNextLine() function in noip2.c misses a |
| length check, leading to a stack-based buffer overflow. |
| </p> |
| </description> |
| <impact type="high"> |
| <p> |
| A remote attacker could exploit this vulnerability to execute arbitrary |
| code by sending a specially crafted HTTP message to the client. NOTE: |
| Successful exploitation requires a man in the middle attack, a DNS |
| spoofing attack or a compromise of no-ip.com servers. |
| </p> |
| </impact> |
| <workaround> |
| <p> |
| There is no known workaround at this time. |
| </p> |
| </workaround> |
| <resolution> |
| <p> |
| All noip-updater users should upgrade to the latest version: |
| </p> |
| <code> |
| # emerge --sync |
| # emerge --ask --oneshot --verbose ">=net-dns/noip-updater-2.1.9"</code> |
| </resolution> |
| <references> |
| <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5297">CVE-2008-5297</uri> |
| </references> |
| <metadata tag="requester" timestamp="Mon, 29 Dec 2008 20:15:03 +0000"> |
| keytoaster |
| </metadata> |
| <metadata tag="submitter" timestamp="Fri, 02 Jan 2009 11:49:22 +0000"> |
| a3li |
| </metadata> |
| <metadata tag="bugReady" timestamp="Sun, 11 Jan 2009 18:28:39 +0000"> |
| p-y |
| </metadata> |
| </glsa> |