Bug 24224 - CVE-2010-1623 - denial of service attack against apr_brigade_split_line()
Summary: CVE-2010-1623 - denial of service attack against apr_brigade_split_line()
Status: CLOSED FIXED
Alias: None
Product: Sisyphus
Classification: Development
Component: libaprutil1 (show other bugs)
Version: unstable
Hardware: all Linux
: P3 blocker
Assignee: Afanasov Dmitry
QA Contact: qa-sisyphus
URL: http://secunia.com/advisories/41701
Keywords: security
Depends on:
Blocks:
 
Reported: 2010-10-05 16:56 MSD by Vladimir Lettiev
Modified: 2010-10-20 09:24 MSD (History)
2 users (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Vladimir Lettiev 2010-10-05 16:56:19 MSD 
An error within the "apr_brigade_split_line()" function in buckets/apr_brigade.c can be exploited to cause high memory consumption.

http://svn.apache.org/viewvc/apr/apr-util/branches/1.3.x/buckets/apr_brigade.c?r1=1002976&r2=1003494&diff_format=h
Comment 1 Boris Savelev 2010-10-06 16:55:41 MSD 
при всем уважении к solo@ я с этим (- http://git.altlinux.org/people/solo/packages/?p=aprutil1.git;a=summary) -- работать боюсь
Comment 2 Anton Farygin 2010-10-06 17:04:40 MSD 
мда, проще с нуля сделать новый репозиторий, согласен.

Точнее - не совсем с нуля, а отсюда:
git checkout ALT/aprutil1/1.3.9-alt2

остальное станет уже проблема Solo.
Comment 3 Boris Savelev 2010-10-06 17:07:49 MSD 
если сам solo@ не сделает до пятницы -- я исправлю
подойдет такое решение?
Comment 4 solo 2010-10-16 01:07:52 MSD 
aprutil1-1.3.10-alt1 (см. http://git.altlinux.org/people/solo/packages/aprutil1.git?p=aprutil1.git;a=commit;h=e9664ef03721303d431f5e121c333ed4049fa47b) на пути в Сизиф
Comment 5 Repository Robot 2010-10-17 01:57:05 MSD 
aprutil1-1.3.10-alt1 -> sisyphus:

* Sat Oct 16 2010 Aleksey Avdeev <solo@altlinux> 1.3.10-alt1
- New version (1.3.10)
- Security fixes (CVE-2009-3560, CVE-2009-3720, CVE-2010-1623)
  (Closes: #24224)