Bugtraqmailing list archives

By Date

By Thread

[ GLSA 200501-21 ] HylaFAX: hfaxd unauthorized login vulnerability

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -Gentoo Linux Security Advisory                           GLSA 200501-21- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -http://security.gentoo.org/- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  Severity: Normal     Title: HylaFAX: hfaxd unauthorized login vulnerability      Date: January 11, 2005      Bugs: #75941        ID: 200501-21- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -Synopsis========HylaFAX is subject to a vulnerability in its username matching code,potentially allowing remote users to bypass access control lists.Background==========HylaFAX is a software package for sending and receiving facsimilemessages.Affected packages=================    -------------------------------------------------------------------     Package           /  Vulnerable  /                     Unaffected    -------------------------------------------------------------------  1  net-misc/hylafax     < 4.2.0-r2                       >= 4.2.0-r2Description===========The code used by hfaxd to match a given username and hostname with anentry in the hosts.hfaxd file is insufficiently protected againstmalicious entries.Impact======If the HylaFAX installation uses a weak hosts.hfaxd file, a remoteattacker could authenticate using a malicious username or hostname andbypass the intended access restrictions.Workaround==========As a workaround, administrators may consider adding passwords to allentries in the hosts.hfaxd file.Resolution==========All HylaFAX users should upgrade to the latest version:    # emerge --sync    # emerge --ask --oneshot --verbose ">=net-misc/hylafax-4.2.0-r2"Note: Due to heightened security, weak entries in the hosts.hfaxd filemay no longer work. Please see the HylaFAX documentation for details ofaccepted syntax in the hosts.hfaxd file.References==========  [ 1 ] CAN-2004-1182http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1182  [ 2 ] HylaFAX Announcementhttp://marc.theaimsgroup.com/?l=hylafax&m=110545119911558&w=2Availability============This GLSA and any updates to it are available for viewing atthe Gentoo Security Website:http://security.gentoo.org/glsa/glsa-200501-21.xmlConcerns?=========Security is a primary focus of Gentoo Linux and ensuring theconfidentiality and security of our users machines is of utmostimportance to us. Any security concerns should be addressed tosecurity () gentoo org or alternatively, you may file a bug athttp://bugs.gentoo.org.License=======Copyright 2005 Gentoo Foundation, Inc; referenced textbelongs to its owner(s).The contents of this document are licensed under theCreative Commons - Attribution / Share Alike license.http://creativecommons.org/licenses/by-sa/2.0

Attachment:signature.asc
Description: OpenPGP digital signature

By Date

By Thread

Current thread:

• [ GLSA 200501-21 ] HylaFAX: hfaxd unauthorized login vulnerabilityThierry Carrez (Jan 11)