First published: Fri Aug 31 2012(Updated: )
GNU Gatekeeper before 3.1 does not limit the number of connections to the status port, which allows remote attackers to cause a denial of service (connection and thread consumption) via a large number of connections.
Credit: secalert@redhat.com
Affected Software | Affected Version | How to fix |
---|---|---|
SUSE Linux | =42.1 | |
SUSE Linux | =13.2 | |
GNU Gatekeeper | <=3.1 | |
GNU Gatekeeper | =2.0.3 | |
GNU Gatekeeper | =2.0.4 | |
GNU Gatekeeper | =2.0.5 | |
GNU Gatekeeper | =2.0.6 | |
GNU Gatekeeper | =2.0.7 | |
GNU Gatekeeper | =2.0.8 | |
GNU Gatekeeper | =2.0.9 | |
GNU Gatekeeper | =2.2.0 | |
GNU Gatekeeper | =2.2.1 | |
GNU Gatekeeper | =2.2.2 | |
GNU Gatekeeper | =2.2.3 | |
GNU Gatekeeper | =2.2.4 | |
GNU Gatekeeper | =2.2.5 | |
GNU Gatekeeper | =2.2.6 | |
GNU Gatekeeper | =2.2.7 | |
GNU Gatekeeper | =2.2.8 | |
GNU Gatekeeper | =2.2.9 | |
GNU Gatekeeper | =2.3.0 | |
GNU Gatekeeper | =2.3.1 | |
GNU Gatekeeper | =2.3.2 | |
GNU Gatekeeper | =2.3.3 | |
GNU Gatekeeper | =2.3.4 | |
GNU Gatekeeper | =2.3.5 | |
GNU Gatekeeper | =3.0 | |
GNU Gatekeeper | =3.0-beta |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2012-3534 is classified as a denial of service vulnerability with moderate severity.
CVE-2012-3534 allows remote attackers to exhaust system resources through an excessive number of connections to the status port.
To address CVE-2012-3534, upgrade to GNU Gatekeeper version 3.1 or later, which includes a limit on connection attempts.
CVE-2012-3534 affects all versions of GNU Gatekeeper prior to 3.1.
Mitigation strategies for CVE-2012-3534 include implementing firewall rules to limit access to the status port.