ID de Prueba:	1.3.6.1.4.1.25623.1.0.51456
Categoría:	Conectiva Local Security Checks
Título:	Conectiva Security Advisory CLA-2003:736
Resumen:	NOSUMMARY
Descripción:	Description: The remote host is missing updates announced in advisory CLA-2003:736. Stunnel is a wrapper for network connections. It can be used to tunnel an unencrypted network connection over a secure connection (encrypted using SSL or TLS) or to provide a secure means of connecting to services that do not natively support encryption. This update fixes two vulnerabilities that affect stunnel versions shipped with Conectiva Linux: 1. SIGCHLD Denial of Service (CVE-2002-1563)[1] Henrik Eriksson found[2] a race in the code that handles the SIGCHLD signal. This vulnerability affects stunnel when configured to listen for incoming connections (instead of being invoked by inetd) and to start a new child process to handle each new connection. A remote attacker can exploit this vulnerability to bring the tunneled service down. 2. File descriptor leak (CVE-2003-0740)[3] Steve Grubb found[4] a file descriptor leak vulnerability in versions prior to 3.26 of stunnel that allows a local attacker to hijack the stunnel server. Since this update brings a new version of stunnel (3.26), several other fixes and minor changes are included as well[5]. Solution: The apt tool can be used to perform RPM package upgrades by running 'apt-get update' followed by 'apt-get upgrade' http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1563 http://marc.theaimsgroup.com/?l=stunnel-users&m=103600188215117&w=2 http://www.securityfocus.com/archive/1/335996 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0740 http://www.stunnel.org/news/ http://www.securityspace.com/smysecure/catid.html?in=CLA-2003:736 http://distro.conectiva.com.br/atualizacoes/index.php?id=a&anuncio=002003 Risk factor : Medium CVSS Score: 4.6
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2002-1563 BugTraq ID: 6592 http://www.securityfocus.com/bid/6592 Bugtraq: 20030112 SIGCHLD problem in Stunnel (Google Search) http://marc.info/?l=bugtraq&m=104247606910598 Conectiva Linux advisory: CLA-2003:736 http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000736 En Garde Linux Advisory: ESA-20030806-020 http://www.linuxsecurity.com/advisories/engarde_advisory-3535.html http://marc.info/?l=stunnel-users&m=103600188215117&w=2 http://www.redhat.com/support/errata/RHSA-2003-221.html http://www.redhat.com/support/errata/RHSA-2003-223.html http://marc.info/?l=bugtraq&m=106029168514511&w=2 Common Vulnerability Exposure (CVE) ID: CVE-2003-0740 Bugtraq: 20030903 Stunnel-3.x Daemon Hijacking (Google Search) http://marc.info/?l=bugtraq&m=106260760211958&w=2 http://www.mandriva.com/security/advisories?name=MDKSA-2003:108 http://www.redhat.com/support/errata/RHSA-2003-297.html
Copyright	Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com

Esta es sólo una de 145615 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.