Lucene search

Gentoo FoundationGLSA-201412-20

HistoryDec 13, 2014 - 12:00 a.m.

GNUstep Base library: Denial of service

2014-12-1300:00:00

Gentoo Foundation

security.gentoo.org

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

0.013 Low

EPSS

Percentile

85.8%

JSON

Background

GNUstep Base library is a free software package implementing the API of the OpenStep Foundation Kit ™, including later additions.

Description

GNUstep Base library does not properly handle the file descriptor for logging, when run as a daemon.

Impact

A remote attacker could send a specially crafted request, possibly resulting in a Denial of Service condition.

Workaround

There is no known workaround at this time.

Resolution

All GNUstep Base library users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose
 "&gt;=gnustep-base/gnustep-base-1.24.6-r1"

OSVersionArchitecturePackageVersionFilename
Gentooanyallgnustep-base/gnustep-base< 1.24.6-r1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Gentoo	any	all	gnustep-base/gnustep-base	< 1.24.6-r1	UNKNOWN

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

0.013 Low

EPSS

Percentile

85.8%

JSON

Related for GLSA-201412-20