DSA-1945

Executive Summary

Summary
Title	New gforge packages fix denial of service

Informations
Name	DSA-1945	First vendor Publication	2009-12-03
Vendor	Debian	Last vendor Modification	2009-12-03
Severity (Vendor)	N/A	Revision	1

Security-Database Scoring CVSS v2

Cvss vector : (AV:L/AC:M/Au:N/C:N/I:P/A:P)
Cvss Base Score	3.3	Attack Range	Local
Cvss Impact Score	4.9	Attack Complexity	Medium
Cvss Expoit Score	3.4	Authentification	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Sylvain Beucler discovered that gforge, a collaborative development tool, is prone to a symlink attack, which allows local users to perform a denial of service attack by overwriting arbitrary files.

For the stable distribution (lenny), this problem has been fixed in version 4.7~rc2-7lenny3.

The oldstable distribution (etch), this problem has been fixed in version 4.5.14-22etch13.

For the testing distribution (squeeze), this problem will be fixed soon.

For the unstable distribution (sid), this problem has been fixed in version 4.8.2-1.

We recommend that you upgrade your gforge packages.