Summary
The remote host is missing an update to libgtop
announced via advisory DSA 098-1.
Solution
https://secure1.securityspace.com/smysecure/catid.html?in=DSA%20098-1
Insight
Two different problems where found in libgtop-daemon:
* The laboratory intexxia found a format string problem in the logging code from libgtop_daemon. There were two logging functions which are called when authorizing a client which could be exploited by a remote user.
* Flavio Veloso found a buffer overflow in the function that authorizes clients
Since libgtop_daemon runs as user nobody both bugs could be used to gain access as the nobody user to a system running libgtop_daemon.
Both problems have been fixed in version 1.0.6-1.1 and we recommend you upgrade your libgtop-daemon package immediately.
Severity
Classification
-
CVE CVE-2001-0927, CVE-2001-0928 -
CVSS Base Score: 7.5
AV:N/AC:L/Au:N/C:P/I:P/A:P
Related Vulnerabilities