| VID |
27333 |
| Severity |
40 |
| Port |
53696 |
| Protocol |
TCP |
| Class |
P2P |
| Detailed Description |
The Open DC hub, according to its version number, has a remote buffer overflow vulnerability. Open DC hub is a Unix/Linux version of the hub software for the Direct Connect network. Direct Connect is a peer-to-peer file sharing network made up by hubs, to which clients can connect. Open DC Hub version 0.7.14 and earlier are vulnerable to a buffer overflow, caused by improper handling of the $RedirectAll command. A remote attacker could exploit this vulnerability to execute arbitrary code on the affected system with administrative privileges.
* Note: This check solely relied on the version number of the remote Open DC hub to assess this vulnerability, so this might be a false positive.
* References:
http://www.securityfocus.com/archive/1/382251
http://www.securityfocus.com/advisories/7565
http://packetstormsecurity.nl/exploits50.html
http://www.linuxsecurity.com/index2.php?option=com_ content&do_pdf=1&id=106940
http://www.securityfocus.com/data/vulnerabilities/exploits/openDCHubBufferOverflowPOC.java
http://www.autistici.org/fdonato/poc/OpenDcHub[0714]BOF-poc.zip
* Platforms Affected:
Joohn, Open DC Hub 0.7.14 and earlier
Unix Any version
Linux Any version |
| Recommendation |
For Gentoo Linux:
Upgrade to the latest version of opendchub (0.7.14-r2 or later), as listed in Gentoo Linux Security Advisory GLSA 200411-37 at http://www.gentoo.org/security/en/glsa/glsa-200411-37.xml
For other distributions:
No upgrade or patch available as of December 2004. Upgrade to the new version of Open DC Hub, when new version fixed this problem becomes available from the SourceForge.net Web site at http://opendchub.sourceforge.net |
| Related URL |
CVE-2004-1127 (CVE) |
| Related URL |
11747 (SecurityFocus) |
| Related URL |
18254 (ISS) |
|
