[Secure-testing-team] Bug#543312: CVE-2009-2732: Basic Authentication Null Pointer Denial of Service
Giuseppe Iuculano
giuseppe at iuculano.it
Mon Aug 24 06:46:17 UTC 2009
Package: ntop
Severity: serious
Tags: security
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hi,
the following CVE (Common Vulnerabilities & Exposures) id was
published for ntop.
CVE-2009-2732[0]:
| The checkHTTPpassword function in http.c in ntop 3.3.10 and earlier
| allows remote attackers to cause a denial of service (NULL pointer
| dereference and daemon crash) via an Authorization HTTP header that
| lacks a : (colon) character in the base64-decoded string.
If you fix the vulnerability please also make sure to include the
CVE id in your changelog entry.
For further information see:
[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2732
http://security-tracker.debian.net/tracker/CVE-2009-2732
Cheers,
Giuseppe.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
iEYEARECAAYFAkqSNzUACgkQNxpp46476aqaRwCePEnRlTpotXKtcCnxSRnqbSoX
imEAnRKiKt/JAzk57KKzHsAMFEo/v66K
=DhPT
-----END PGP SIGNATURE-----
More information about the Secure-testing-team
mailing list