Alerts This Week
Warning Icon 1 758
Alerts This Week
Warning Icon 1 758

Gentoo: GLSA-202310-01 Moderate: Network Service Exploit Vulnerability

gentoo
Calendar Grey November 7, 2019
Dist Gentoo Esm H88
An integer overflow in Debian’s web server might allow attackers to execute arbitrary code when users access compromised websites.
A buffer overflow in pump might allow remote attacker to execute arbitrary code.

Summary

It was discovered that there was an arbitrary code execution vulnerability in the pump DHCP/BOOTP client.

Topics%20covered

Topics Covered

security advisory Gentoo buffer overflow arbitrary code execution remote attack pump normal severity

Resolution

Gentoo has discontinued support for pump. We recommend that usersunmerge pump: # emerge --unmerge "net-misc/pump"

References

[ 1 ] Debian Bug Report 933674

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201911-02
style>.gentoo_availability{display:block;}

Concerns

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.

Severity
important
Lowest
Low
Medium
High
Critical

Severity: Normal
Title: pump: User-assisted execution of arbitrary code
Date: November 07, 2019
Bugs: #694314
ID: 201911-02

Topics%20covered

Topics Covered

security advisory Gentoo buffer overflow arbitrary code execution remote attack pump normal severity

Synopsis

A buffer overflow in pump might allow remote attacker to execute arbitrary code.

Background

BOOTP and DHCP client for automatic IP configuration.

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Affected Packages

------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 net-misc/pump <= 0.8.24-r4 Vulnerable! ------------------------------------------------------------------- NOTE: Certain packages are still vulnerable. Users should migrate to another package if one is available or wait for the existing packages to be marked stable by their architecture maintainers.

Impact

===== A remote attacker, by enticing a user to connect to a malicious server, could cause the execution of arbitrary code with the privileges of the user running pump DHCP/BOOTP client.

Workaround

There is no known workaround at this time.

Your message here