|
|
Family: Mandrake Local Security Checks --> Category: infos
MDKSA-2002:004: stunnel Vulnerability Scan
Vulnerability Scan Summary
Check for the version of the stunnel package
Detailed Explanation for this Vulnerability Test
The remote host is missing the patch for the advisory MDKSA-2002:004 (stunnel).
All versions of stunnel from 3.15 to 3.21c are vulnerable to format string bugs
in the functions which implement smtp, pop, and nntp client negotiations. Using
stunnel with the '-n service' option and the '-c' client mode option, a
malicious server could use the format sting vulnerability to run arbitrary code
as the owner of the current stunnel process. Version 3.22 is not vulnerable to
this bug.
Solution : http://wwwnew.mandriva.com/security/advisories?name=MDKSA-2002:004
Threat Level: High
Click HERE for more information and discussions on this network vulnerability scan.
|
