https://bugzilla.redhat.com/show_bug.cgi?id=1377280
Bug ID: 1377280
Summary: CVE-2016-5017 zookeeper: Buffer overflow vulnerability
in C cli shell
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: low
Priority: low
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: abhgupta(a)redhat.com, aileenc(a)redhat.com,
alazarot(a)redhat.com, aszczucz(a)redhat.com,
chazlett(a)redhat.com, ctubbsii(a)fedoraproject.org,
dmcphers(a)redhat.com, ethan(a)ethantuttle.com,
etirelli(a)redhat.com, felias(a)redhat.com,
gvarsami(a)redhat.com, hchiorea(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jcoleman(a)redhat.com, jialiu(a)redhat.com,
jokerman(a)redhat.com, jolee(a)redhat.com,
kconner(a)redhat.com, kseifried(a)redhat.com,
kverlaen(a)redhat.com, ldimaggi(a)redhat.com,
lmeyer(a)redhat.com, lpetrovi(a)redhat.com,
mbaluch(a)redhat.com, mmccomas(a)redhat.com,
mwinkler(a)redhat.com, nwallace(a)redhat.com,
pavelp(a)redhat.com, rrajasek(a)redhat.com,
rwagner(a)redhat.com, rzhang(a)redhat.com,
soa-p-jira(a)post-office.corp.redhat.com, s(a)shk.io,
tcunning(a)redhat.com, tiwillia(a)redhat.com,
tkirby(a)redhat.com, tstclair(a)redhat.com,
vhalbert(a)redhat.com
The ZooKeeper C client shells "cli_st" and "cli_mt" have a buffer
overflow
vulnerability associated with parsing of the input command when using the
"cmd:<cmd>" batch mode syntax. If the command string exceeds 1024
characters a
buffer overflow will occur. There is no known compromise which takes advantage
of this vulnerability, and if security is enabled the attacker would be limited
by client level security constraints. The C cli shell is intended as a
sample/example of how to use the C client interface, not as a production tool -
the documentation has also been clarified on this point.
References:
http://seclists.org/bugtraq/2016/Sep/29
Upstream fix:
https://git-wip-us.apache.org/repos/asf?p=zookeeper.git;a=commitdiff;h=27...
--
You are receiving this mail because:
You are on the CC list for the bug.