-------------------------------------------------------------------------------
GENTOO LINUX SECURITY ANNOUNCEMENT 200310-02
-------------------------------------------------------------------------------
Package : cfengine
Summary : stack overflow in cfengine network code
Date : 2003-10-04 23:30 UTC
Exploit : remote
Versions Affected : < 2.0.8, 2.1.0a6-a9
Fixed Version : >= 2.0.8, >=2.1.0b1
Gentoo Bug ID : 28910
CVE : we are not aware of any at this time
-------------------------------------------------------------------------------

DESCRIPTION
===========

From the bugtraq posting:

"There is an exploitable stack overflow in the network I/O code used in the
cfservd daemon in Cfengine 2.x prior to version 2.0.8. Arbitrary code
execution has been demonstrated on x86 FreeBSD and is believed to be possible
on all platforms.

Cfengine 1 is not vulnerable, but downgrading is not recommended as version 1
is nolonger supported by the author."

Read the full advisory at:
<http://packetstormsecurity.nl/0309-advisories/cfengine.txt>


SOLUTION
========

It is recommended that all Gentoo Linux users who are using net-misc/cfengine
upgrade to a fixed version.

emerge sync
emerge -p cfengine
emerge cfengine
emerge clean

-------------------------------------------------------------------------------
Kurt Lieber 
klieber@gentoo.org <mailto:klieber@gentoo.org>

GPG Key is available at <http://dev.gentoo.org/~klieber/klieber.gpg>
-------------------------------------------------------------------------------