Pavuk: Multiple buffer overflows

1. Gentoo Linux Security Advisory

Advisory Reference	GLSA 200411-19 / pavuk
Release Date	November 10, 2004
Latest Revision	November 10, 2004: 01
Impact	normal
Exploitable	remote

Package	Vulnerable versions	Unaffected versions	Architecture(s)
net-misc/pavuk	< 0.9.31	>= 0.9.31	All supported architectures

Related bugreports: #70516

Synopsis

Pavuk contains multiple buffer overflows that can allow a remote attacker to run arbitrary code.

2. Impact Information

Background

Pavuk is web spider and website mirroring tool.

Description

Pavuk contains several buffer overflow vulnerabilities in the code handling digest authentication and HTTP header processing. This issue is similar to GLSA 200407-19, but contains more vulnerabilities.

Impact

A remote attacker could cause a buffer overflow, leading to arbitrary code execution with the rights of the user running Pavuk.

3. Resolution Information

Workaround

There is no known workaround at this time.

Resolution

All Pavuk users should upgrade to the latest version:

Code Listing 3.1: Resolution

# emerge --sync
# emerge --ask --oneshot --verbose ">=net-misc/pavuk-0.9.31"

4. References

Updated November 10, 2004

Summary: This is a Gentoo Linux Security Advisory

Security Team
Contact Address

Donate to support our development efforts.