FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

leafnode fetchnews denial-of-service triggered by truncated transmission

Affected packages
leafnode <= 1.9.47

Details

VuXML ID a051a4ec-3aa1-4dd1-9bdc-a61eb5700153
Discovery 2004-01-08
Entry 2004-05-21
Modified 2005-05-13

When a downloaded news article ends prematurely, i. e. when the server sends [CR]LF.[CR]LF before sending a blank line, fetchnews may wait indefinitely for data that never arrives. Workaround: configure "minlines=1" (or use a bigger value) in the configuration file. Found by Toni Viemerö.

References

CVE Name CVE-2004-2068
FreeBSD PR ports/61105
Message 20040109015625.GA12319@merlin.emma.line.org
Message 20040109015625.GA12319@merlin.emma.line.org
URL http://leafnode.sourceforge.net/leafnode-SA-2004-01.txt
URL http://sourceforge.net/tracker/index.php?func=detail&aid=873149&group_id=57767&atid=485349

Copyright © 2003-2005 Jacques Vidrine and contributors.
Please see the source of this document for full copyright information.