mirror/freebsd-ports
1
0
Fork 0
mirror of https://git.FreeBSD.org/ports.git synced 2024-12-01 01:17:02 +00:00
Code Issues Releases Activity

security/vuxml: Mark zeek < 4.0.6 as vulnerable as per:

Browse Source 
https://github.com/zeek/zeek/releases/tag/v4.0.6

 - Fix potential unbounded state growth in the FTP analyzer when
   receiving a specially-crafted stream of commands. This may lead
   to a buffer overflow and cause Zeek to crash. Due to the possibility
   of this happening with packets received from the network, this
   is a potential DoS vulnerabilty.

Reported by:    Tim Wojtulewicz
This commit is contained in:
Craig Leres 2022-04-21 15:43:25 -07:00
parent 21c2f510ea
commit 84a7773d27
1 changed files with 30 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

30
security/vuxml/vuln-2022.xml
View File

@ -1,3 +1,33 @@
<vuln vid="a00c76d9-0c05-4d99-bef7-ae4521cb2a4d">
<topic>zeek -- potential DoS vulnerabilty</topic>
<affects>
<package>
<name>zeek</name>
<range><lt>4.0.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tim Wojtulewicz of Corelight reports:</p>
<blockquote cite="https://github.com/zeek/zeek/releases/tag/v4.0.6">
<p> Fix potential unbounded state growth in the FTP
analyzer when receiving a specially-crafted stream of
commands. This may lead to a buffer overflow and cause
Zeek to crash. Due to the possibility of this happening
with packets received from the network, this is a potential
DoS vulnerabilty. </p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/zeek/zeek/releases/tag/v4.0.6</url>
</references>
<dates>
<discovery>2022-04-21</discovery>
<entry>2022-04-21</entry>
</dates>
</vuln>
<vuln vid="b019585a-bfea-11ec-b46c-b42e991fc52e">
<topic>zgrep -- arbitrary file write</topic>
<affects>