Stack-based buffer overflow in Open Direct Connect Hub (aka Open DC Hub or OpenDCHub) 0.8.1 allows remote authenticated users to execute arbitrary code via a long MyINFO message.

The remote host is affected by the vulnerability described in GLSA-201311-12 (Open DC Hub: Arbitrary code execution)

    A stack-based buffer overflow flaw has been discovered in the way Open       DC Hub sanitized content of a user&rsquo;s MyINFO message.
  Impact :

    A remote authenticated user may be able to execute arbitrary code or       cause a Denial of Service condition via specially crafted MyINFO message.
  Workaround :

    There is no known workaround at this time.

Fix for stack overflow bug. CVE ID: CVE-2010-1147

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
70996	GLSA-201311-12 : Open DC Hub: Arbitrary code execution	Nessus	Gentoo Local Security Checks	medium
47438	Fedora 13 : opendchub-0.8.2-2.fc13 (2010-6478)	Nessus	Fedora Local Security Checks	medium
47437	Fedora 11 : opendchub-0.8.2-2.fc11 (2010-6426)	Nessus	Fedora Local Security Checks	medium
47436	Fedora 12 : opendchub-0.8.2-2.fc12 (2010-6415)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2010-1147

high

Tenable Plugins

medium

medium

medium

medium