FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2013-1428

This CVE name corresponds to:

Entered Topic
2013-04-22 tinc -- Buffer overflow

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

Details

Type Candidate
Name CVE-2013-1428
Phase Assigned(20130126)

Description

Stack-based buffer overflow in the receive_tcppacket function in net_packet.c in tinc before 1.0.21 and 1.1 before 1.1pre7 allows remote authenticated peers to cause a denial of service (crash) or possibly execute arbitrary code via a large TCP packet.

References

Source Reference
MLIST [tinc] 20130422 [Announcement] Tinc version 1.0.21 and 1.1pre7 released
MISC http://freecode.com/projects/tinc/releases/354122
CONFIRM http://www.tinc-vpn.org/news/
CONFIRM https://github.com/gsliepen/tinc/commit/17a33dfd95b1a29e90db76414eb9622df9632320
DEBIAN DSA-2663
FEDORA FEDORA-2013-7085
FEDORA FEDORA-2013-7120
FEDORA FEDORA-2013-7128
BID 59369
OSVDB 92653
SECUNIA 53087
SECUNIA 53108