CVE-2008-3651: memory leak

Debian Bug report logs - #495214
CVE-2008-3651: memory leak

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Steffen Joeris <steffen.joeris@skolelinux.de>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: CVE-2008-3651: memory leak

Date: Fri, 15 Aug 2008 22:56:26 +1000

Package: ipsec-tools
Severity: grave
Tags: security
Justification: user security hole

Hi,
the following CVE (Common Vulnerabilities & Exposures) id was
published for ipsec-tools.

CVE-2008-3651[0]:
| Memory leak in racoon/proposal.c in the racoon daemon in ipsec-tools
| before 0.7.1 allows remote authenticated users to cause a denial of
| service (memory consumption) via invalid proposals.

There is an upstream discussion going on here[1].

If you fix the vulnerability please also make sure to include the
CVE id in your changelog entry.

Cheers
Steffen

For further information see:

[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3651
    http://security-tracker.debian.net/tracker/CVE-2008-3651

[1] http://sourceforge.net/mailarchive/forum.php?thread_name=48a0c7a0.qPeWZAE0PY8bDDq%2B%25olel%40ans.pl&forum_name=ipsec-tools-devel

Message #16 received at 495214@bugs.debian.org (full text, mbox, reply):

From: Thomas Viehmann <tv@beamnet.de>

To: 495214@bugs.debian.org

Cc: debian-release@lists.debian.org

Subject: ipsec-tools in unstable fixes RC bug

Date: Sat, 30 Aug 2008 13:47:41 +0200

Hi,

apparently, #495214: CVE-2008-3651: memory leak is fixed in unstable by
virtue of the new upstream release without the maintainer knowing /
noting it in the changelog.

The new upstream release has a largish diff to the version in testing,
does the release team want the version from unstable or a backported fix?

Kind regards

T.
-- 
Thomas Viehmann, http://thomas.viehmann.net/

Message #21 received at 495214@bugs.debian.org (full text, mbox, reply):

From: Luk Claes <luk@debian.org>

To: Thomas Viehmann <tv@beamnet.de>

Cc: 495214@bugs.debian.org, debian-release@lists.debian.org

Subject: Re: ipsec-tools in unstable fixes RC bug

Date: Sun, 31 Aug 2008 20:01:47 +0200

Thomas Viehmann wrote:
> Hi,
> 
> apparently, #495214: CVE-2008-3651: memory leak is fixed in unstable by
> virtue of the new upstream release without the maintainer knowing /
> noting it in the changelog.
> 
> The new upstream release has a largish diff to the version in testing,
> does the release team want the version from unstable or a backported fix?

unblocked

Cheers

Luk

Message #26 received at 495214@bugs.debian.org (full text, mbox, reply):

From: Ganesan Rajagopal <rganesan@gmail.com>

To: Thomas Viehmann <tv@beamnet.de>, 495214@bugs.debian.org

Cc: debian-release@lists.debian.org

Subject: Re: Bug#495214: ipsec-tools in unstable fixes RC bug

Date: Tue, 2 Sep 2008 10:15:48 +0530

On Sat, Aug 30, 2008 at 01:47:41PM +0200, Thomas Viehmann wrote:
> Hi,
> 
> apparently, #495214: CVE-2008-3651: memory leak is fixed in unstable by
> virtue of the new upstream release without the maintainer knowing /
> noting it in the changelog.

I wasn't aware of this CVE when I uploaded the version instable. I
missed the freeze by just a few hours :-(. 

> The new upstream release has a largish diff to the version in testing,
> does the release team want the version from unstable or a backported fix?

Though the diff is large, it's a bug fix release which I uploaded at the
last minute trying to beat the freeze (and missed it!). I'd request the
unstable version to move into testing. I see that it's been already done
- thanks :-). 

Ganesan

-- 
Ganesan Rajagopal

Message #31 received at 495214-done@bugs.debian.org (full text, mbox, reply):

From: Nico Golde <nion@debian.org>

To: 495214-done@bugs.debian.org

Subject: closing

Date: Fri, 3 Oct 2008 15:00:43 +0200

[Message part 1 (text/plain, inline)]

Version: 1:0.7.1-1

-- 
Nico Golde - http://www.ngolde.de - nion@jabber.ccc.de - GPG: 0x73647CFF
For security reasons, all text in this mail is double-rot13 encrypted.

[Message part 2 (application/pgp-signature, inline)]

Send a report that this bug log contains spam.