ID de Prueba:	1.3.6.1.4.1.25623.1.0.703512
Categoría:	Debian Local Security Checks
Título:	Debian Security Advisory DSA 3512-1 (libotr - security update)
Resumen:	Markus Vervier of X41 D-Sec GmbH discovered;an integer overflow vulnerability in libotr, an off-the-record (OTR) messaging;library, in the way how the sizes of portions of incoming messages were stored. A;remote attacker can exploit this flaw by sending crafted messages to an;application that is using libotr to perform denial of service attacks;(application crash), or potentially, execute arbitrary code with the;privileges of the user running the application.
Descripción:	Summary: Markus Vervier of X41 D-Sec GmbH discovered an integer overflow vulnerability in libotr, an off-the-record (OTR) messaging library, in the way how the sizes of portions of incoming messages were stored. A remote attacker can exploit this flaw by sending crafted messages to an application that is using libotr to perform denial of service attacks (application crash), or potentially, execute arbitrary code with the privileges of the user running the application. Affected Software/OS: libotr on Debian Linux Solution: For the oldstable distribution (wheezy), this problem has been fixed in version 3.2.1-1+deb7u2. For the stable distribution (jessie), this problem has been fixed in version 4.1.0-2+deb8u1. We recommend that you upgrade your libotr packages. CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2016-2851 BugTraq ID: 84285 http://www.securityfocus.com/bid/84285 Bugtraq: 20160309 Advisory X41-2016-001: Memory Corruption Vulnerability in "libotr" (Google Search) http://www.securityfocus.com/archive/1/537745/100/0/threaded Debian Security Information: DSA-3512 (Google Search) http://www.debian.org/security/2016/dsa-3512 https://www.exploit-db.com/exploits/39550/ http://seclists.org/fulldisclosure/2016/Mar/21 https://security.gentoo.org/glsa/201701-10 https://www.x41-dsec.de/lab/advisories/x41-2016-001-libotr/ https://lists.cypherpunks.ca/pipermail/otr-users/2016-March/002581.html SuSE Security Announcement: openSUSE-SU-2016:0708 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00021.html SuSE Security Announcement: openSUSE-SU-2016:0732 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00030.html http://www.ubuntu.com/usn/USN-2926-1
Copyright	Copyright (C) 2016 Greenbone Networks GmbH

Esta es sólo una de 99761 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.