868426 – (CVE-2014-2386) VUL-0: CVE-2014-2386: icinga: 1 byte strcpy overflows

Bug 868426 (CVE-2014-2386) - VUL-0: CVE-2014-2386: icinga: 1 byte strcpy overflows

Summary: VUL-0: CVE-2014-2386: icinga: 1 byte strcpy overflows

Status:	RESOLVED FIXED

Alias:	CVE-2014-2386

Product:	SUSE Security Incidents
Classification:	Novell Products
Component:	Incidents (show other bugs)
Version:	unspecified
Hardware:	Other openSUSE 13.1

Priority:	P5 - None Severity: Normal
Target Milestone:	---
Assignee:	Tim Hardeck
QA Contact:	Security Team bot

URL:	https://smash.suse.de/issue/97008/
Whiteboard:
Keywords:

Depends on:
Blocks:

Clone This Bug

Reported:	2014-03-14 12:04 UTC by Marcus Meissner
Modified:	2015-02-19 07:34 UTC (History)
CC List:	1 user (show)

See Also:
Found By:	Security Response Team
Services Priority:
Business Priority:
Blocker:	---
Marketing QA Status:	---
IT Deployment:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Marcus Meissner 2014-03-14 12:04:45 UTC

OSS:12355

The icinga team silently fixed some single byte \0 overflows.

https://git.icinga.org/?p=icinga-core.git;a=commitdiff;h=73285093b71a5551abdaab0a042d3d6bae093b0d

(also the non public
https://dev.icinga.org/issues/5663
is referenced by commit above)


References: 
http://comments.gmane.org/gmane.comp.security.oss.general/12355 https://git.icinga.org/?p=icinga-core.git;a=commitdiff;h=73285093b71a5551abdaab0a042d3d6bae093b0d

Comment 1 Bernhard Wiedemann 2014-03-14 14:00:39 UTC

This is an autogenerated message for OBS integration:
This bug (868426) was mentioned in
https://build.opensuse.org/request/show/225945 13.1 / icinga
https://build.opensuse.org/request/show/225950 12.3 / icinga

Comment 2 Tim Hardeck 2014-03-17 08:21:21 UTC

All packages were accepted.

Comment 3 Swamp Workflow Management 2014-03-24 09:04:22 UTC

openSUSE-SU-2014:0420-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 868426
CVE References: CVE-2014-2386
Sources used:
openSUSE 13.1 (src):    icinga-1.10.2-4.14.1
openSUSE 12.3 (src):    icinga-1.10.2-2.12.1