GLSA-201202-08

Executive Summary

Summary
Title	stunnel: Arbitrary code execution

Informations
Name	GLSA-201202-08	First vendor Publication	2012-02-29
Vendor	Gentoo	Last vendor Modification	2012-02-29
Severity (Vendor)	Normal	Revision	N/A

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C)
Cvss Base Score	9.3	Attack Range	Network
Cvss Impact Score	10	Attack Complexity	Medium
Cvss Expoit Score	8.6	Authentification	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Synopsis

A vulnerability was found in stunnel, allowing remote attackers to cause a Denial of Service and potentially arbitrary code execution.

Background

The stunnel program is designed to work as an SSL encryption wrapper between a client and a local or remote server.

Description

An unspecified heap vulnerability was discovered in stunnel.

Impact

The vulnerability may possibly be leveraged to perform remote code execution or a Denial of Service attack.

Workaround

There is no known workaround at this time.

Resolution

All stunnel users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-misc/stunnel-4.44"

References

[ 1 ] CVE-2011-2940 : http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2940

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-201202-08.xml