CVE-2004-1702: Medium severity GNU CFEngine vulnerability
Published Aug 9, 2004
·Updated
The AuthenticationDialogue function in cfservd for Cfengine 2.0.0 to 2.1.7p1 does not properly check the return value of the ReceiveTransaction function, which leads to a failed malloc call and triggers to a null dereference, which allows remote attackers to cause a denial of service (crash).
Affected Software
20 affected components
GNU CFEngine=2.0.0
GNU CFEngine=2.0.1
GNU CFEngine=2.0.2
GNU CFEngine=2.0.3
GNU CFEngine=2.0.4
GNU CFEngine=2.0.5
GNU CFEngine=2.0.5-b1
GNU CFEngine=2.0.5-pre
GNU CFEngine=2.0.5-pre2
GNU CFEngine=2.0.6
GNU CFEngine=2.0.7
GNU CFEngine=2.0.7-p1
GNU CFEngine=2.0.7-p2
GNU CFEngine=2.0.7-p3
GNU CFEngine=2.0.8
GNU CFEngine=2.0.8-p1
GNU CFEngine=2.1.0-a6
GNU CFEngine=2.1.0-a8
GNU CFEngine=2.1.0-a9
GNU CFEngine=2.1.7-p1
Remediation
Patch Available
Patch Available
Patch Available
Event History
Aug 9, 2004
CVE Published
04:00 AM
Feb 21, 2005
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2004-1702?
CVE-2004-1702 is classified as a denial-of-service vulnerability that can crash the service.
2
How do I fix CVE-2004-1702?
To fix CVE-2004-1702, upgrade to a patched version of GNU CFEngine that is beyond 2.1.7p1.
3
Which software versions are affected by CVE-2004-1702?
CVE-2004-1702 affects GNU CFEngine versions from 2.0.0 to 2.1.7p1.
4
What kind of attack does CVE-2004-1702 enable?
CVE-2004-1702 allows remote attackers to cause a denial of service by triggering a null dereference.
5
What is the root cause of CVE-2004-1702?
The root cause of CVE-2004-1702 is improper checks on the return value of the ReceiveTransaction function.