A vulnerability has been discovered in Ventrilo, allowing for a Denial of Service.
|Package||media-sound/ventrilo-server-bin on all architectures|
|Affected versions||< 3.0.3|
|Unaffected versions||>= 3.0.3|
Ventrilo is a Voice over IP group communication server.
Luigi Auriemma reported a NULL pointer dereference in Ventrilo when processing packets with an invalid version number followed by another packet.
A remote attacker could send specially crafted packets to the server, resulting in a crash.
There is no known workaround at this time.
All Ventrilo users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-sound/ventrilo-server-bin-3.0.3"
April 14, 2009
April 14, 2009: 01