oss-security - CVE request: ctorrent

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / NEWS community lists Wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [thread-next>] [month] [year] [list]

Date: Wed, 20 May 2009 14:17:25 -0600
From: Vincent Danen <vdanen@...hat.com>
To: oss-security@...ts.openwall.com
Subject: CVE request: ctorrent

Hi there.  There was a stack-based buffer overflow issue found in
Enhanced CTorrent (dtorrent and ctorrent) that I don't believe has received
a CVE name.  References as noted:

https://bugzilla.redhat.com/show_bug.cgi?id=501813
http://milw0rm.com/exploits/8470
http://bugs.gentoo.org/show_bug.cgi?id=266953
http://secunia.com/advisories/34752/
http://sourceforge.net/tracker/?func=detail&aid=2782875&group_id=202532&atid=981959
http://www.securityfocus.com/bid/34584

with the upstream fix here:

http://dtorrent.svn.sourceforge.net/viewvc/dtorrent/dtorrent/trunk/btfiles.cpp?r1=296&r2=301&view=patch

Thanks.

-- 
Vincent Danen / Red Hat Security Response Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.