iodine 'iodined' Remote Denial of Service Vulnerability

Bugtraq ID:	34731
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	Apr 27 2009 12:00AM
Updated:	Apr 28 2009 07:06PM
Credit:	martin f krafft
Vulnerable:	Kryo iodine 0.4.2 Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 armel Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0
Not Vulnerable:	Kryo iodine 0.5.1

iodine 'iodined' Remote Denial of Service Vulnerability

The 'iodine' program is prone to a remote denial-of-service vulnerability because it fails to handle user-supplied input.

An attacker can exploit this issue to crash the application, denying service to legitimate users.

This issue affects iodine 0.4.2; other versions may also be affected.

iodine 'iodined' Remote Denial of Service Vulnerability

To exploit this issue, attackers can use readily available packet generators.

The following exploit code is available:

• /data/vulnerabilities/exploits/34731.pl

iodine 'iodined' Remote Denial of Service Vulnerability

Solution:
The vendor has released an update. Please see the references for more information.

iodine 'iodined' Remote Denial of Service Vulnerability

References:

• Iodine Changelog (Kryo)
  
• Iodine Homepage (Kryo)
  
• iodined: segfaults when client connects (martin f krafft)