Test Kennung:	1.3.6.1.4.1.25623.1.0.51456
Kategorie:	Conectiva Local Security Checks
Titel:	Conectiva Security Advisory CLA-2003:736
Zusammenfassung:	NOSUMMARY
Beschreibung:	Description: The remote host is missing updates announced in advisory CLA-2003:736. Stunnel is a wrapper for network connections. It can be used to tunnel an unencrypted network connection over a secure connection (encrypted using SSL or TLS) or to provide a secure means of connecting to services that do not natively support encryption. This update fixes two vulnerabilities that affect stunnel versions shipped with Conectiva Linux: 1. SIGCHLD Denial of Service (CVE-2002-1563)[1] Henrik Eriksson found[2] a race in the code that handles the SIGCHLD signal. This vulnerability affects stunnel when configured to listen for incoming connections (instead of being invoked by inetd) and to start a new child process to handle each new connection. A remote attacker can exploit this vulnerability to bring the tunneled service down. 2. File descriptor leak (CVE-2003-0740)[3] Steve Grubb found[4] a file descriptor leak vulnerability in versions prior to 3.26 of stunnel that allows a local attacker to hijack the stunnel server. Since this update brings a new version of stunnel (3.26), several other fixes and minor changes are included as well[5]. Solution: The apt tool can be used to perform RPM package upgrades by running 'apt-get update' followed by 'apt-get upgrade' http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1563 http://marc.theaimsgroup.com/?l=stunnel-users&m=103600188215117&w=2 http://www.securityfocus.com/archive/1/335996 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0740 http://www.stunnel.org/news/ http://www.securityspace.com/smysecure/catid.html?in=CLA-2003:736 http://distro.conectiva.com.br/atualizacoes/index.php?id=a&anuncio=002003 Risk factor : Medium CVSS Score: 4.6
Querverweis:	Common Vulnerability Exposure (CVE) ID: CVE-2002-1563 BugTraq ID: 6592 http://www.securityfocus.com/bid/6592 Bugtraq: 20030112 SIGCHLD problem in Stunnel (Google Search) http://marc.info/?l=bugtraq&m=104247606910598 Conectiva Linux advisory: CLA-2003:736 http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000736 En Garde Linux Advisory: ESA-20030806-020 http://www.linuxsecurity.com/advisories/engarde_advisory-3535.html http://marc.info/?l=stunnel-users&m=103600188215117&w=2 http://www.redhat.com/support/errata/RHSA-2003-221.html http://www.redhat.com/support/errata/RHSA-2003-223.html http://marc.info/?l=bugtraq&m=106029168514511&w=2 Common Vulnerability Exposure (CVE) ID: CVE-2003-0740 Bugtraq: 20030903 Stunnel-3.x Daemon Hijacking (Google Search) http://marc.info/?l=bugtraq&m=106260760211958&w=2 http://www.mandriva.com/security/advisories?name=MDKSA-2003:108 http://www.redhat.com/support/errata/RHSA-2003-297.html
Copyright	Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com

Dies ist nur einer von 145615 Anfälligkeitstests in unserem Testpaket. Finden Sie mehr über unsere vollständigen Sicherheitsüberprüfungen heraus. Um einen gratis Test für diese Anfälligkeit auf Ihrem System durchlaufen zu lassen, registrieren Sie sich bitte unten.