vendor:
cfengine
by:
jsk
7.5
CVSS
HIGH
Stack-Based Buffer Overrun
119
CWE
Product Name: cfengine
Affected Version From: cfengine2-2.0.3
Affected Version To: cfengine2-2.0.3
Patch Exists: YES
Related CWE: N/A
CPE: a:cfengine:cfengine
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: Linux
2003
cfengine Stack-Based Buffer Overrun Vulnerability
cfengine is prone to a stack-based buffer overrun vulnerability. This issue may be exploited by remote attackers who can send malicious transaction packets to cfservd. This issue is due to insufficient bounds checking of data that is read in during a transaction with a remote user. The vulnerability may be exploited to execute arbitrary code with the privileges of cfservd. A denial of service may also be the result of exploitation attempts as cfservd is multi-threaded and may not be configured to restart itself via a super-server such as inetd.
Mitigation:
Ensure that cfengine is updated to the latest version and that all security patches are applied.