OpenPKG Security Advisory

Publisher Name:          OpenPKG GmbH
Publisher Home:          http://openpkg.com/

Advisory Id (public):    OpenPKG-SA-2004.001
Advisory Type:           OpenPKG Security Advisory (SA)
Advisory Directory:      http://openpkg.com/go/OpenPKG-SA
Advisory Document:       http://openpkg.com/go/OpenPKG-SA-2004.001
Advisory Published:      2010-02-09 09:38 UTC

Issue Id (internal):     OpenPKG-SI-20040108.01
Issue First Created:     2004-01-08
Issue Last Modified:     2006-11-28
Issue Revision:          06


Subject Name:            INN
Subject Summary:         InterNetNews Usenet Server
Subject Home:            http://www.isc.org/products/INN/
Subject Versions:        * <= 2.4.0

Vulnerability Id:        none
Vulnerability Scope:     global (not OpenPKG specific)

Attack Feasibility:      run-time
Attack Vector:           remote network
Attack Impact:           arbitrary code execution

Description:
    According to INN [0] announcement postings from Russ Allbery [1][2],
    Dan Riley discovered a buffer overflow in a portion of the control
    message handling code, first introduced in INN 2.4.0. It is fairly
    likely that this overflow is remotely exploitable to gain access and
    execute code under the user innd(8) runs as. INN 2.3.x and earlier
    versions are not affected.

References:
    [0] http://www.isc.org/products/INN/
    [1] http://lists.litech.org/pipermail/inn-workers/2004q1/002762.html
    [2] http://lists.litech.org/pipermail/inn-workers/2004q1/002763.html
    [3] http://www.openpkg.org/tutorial.html#regular-source
    [4] http://www.openpkg.org/tutorial.html#regular-binary
    [5] ftp://ftp.openpkg.org/release/1.3/UPD/inn-2.4.0-1.3.1.src.rpm
    [6] ftp://ftp.openpkg.org/release/1.3/UPD/
    [7] http://www.openpkg.org/security.html#signature


Primary Package Name:    inn
Primary Package Home:    http://openpkg.org/go/package/inn

Affected Distribution:   Affected Branch:  Affected Package:
OpenPKG Community        1.2-SOLID         n/a
OpenPKG Community        1.3-SOLID         inn-2.4.0-1.3.0
OpenPKG Community        CURRENT           inn-2.4.0-20031111

Corrected Distribution:  Corrected Branch: Corrected Package:
OpenPKG Community        1.2-SOLID         n/a
OpenPKG Community        1.3-SOLID         inn-2.4.0-1.3.1
OpenPKG Community        CURRENT           inn-2.4.0-20040108