neon 0.28.0 through 0.28.2 allows remote servers to cause a denial of service (NULL pointer dereference and crash) via vectors related to Digest authentication, Digest domain parameter support, and the parse_domain function.

Joe Orton discovered that neon did not correctly handle SSL certificates with zero bytes in the Common Name. A remote attacker could exploit this to perform a man in the middle attack to view sensitive information or alter encrypted communications.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update of neon fixes a NULL pointer dereference in the digest authentication code. (CVE-2008-3746)

A security vulnerability has been identified and fixed in neon :

neon 0.28.0 through 0.28.2 allows remote servers to cause a denial of service (NULL pointer dereference and crash) via vectors related to Digest authentication and Digest domain parameter support (CVE-2008-3746).

The updated packages have been upgraded to version 0.28.3 to prevent this.

This update includes the latest release of neon, fixing a security issue in the Digest authentication domain parameter support.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Joe Orton reports :

A NULL pointer deference in the Digest authentication support in neon versions 0.28.0 through 0.28.2 inclusive allows a malicious server to crash a client application, resulting in possible denial of service.

ID	Name	Product	Family	Severity
41046	Ubuntu 6.06 LTS / 8.04 LTS / 8.10 / 9.04 : neon, neon27 vulnerabilities (USN-835-1)	Nessus	Ubuntu Local Security Checks	medium
40028	openSUSE Security Update : libneon-devel (libneon-devel-166)	Nessus	SuSE Local Security Checks	medium
37634	Mandriva Linux Security Advisory : libneon0.27 (MDVSA-2009:074)	Nessus	Mandriva Local Security Checks	medium
34422	Fedora 9 : neon-0.28.3-1.fc9 (2008-7661)	Nessus	Fedora Local Security Checks	medium
34188	FreeBSD : neon -- NULL pointer dereference in Digest domain support (755fa519-80a9-11dd-8de5-0030843d3802)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2008-3746

high

Tenable Plugins

medium

medium

medium

medium

medium