BarnOwl 'libzephyr' Multiple Remote Denial of Service Vulnerabilities

Bugtraq ID:	42318
Class:	Design Error
CVE:	CVE-2010-2725
Remote:	Yes
Local:	No
Published:	Jul 24 2010 12:00AM
Updated:	Jul 24 2010 12:00AM
Credit:	[email protected]
Vulnerable:	MIT BarnOwl 1.6.1 MIT BarnOwl 1.5.1 MIT BarnOwl 1.5 MIT BarnOwl 1.0.5 MIT BarnOwl 1.0.4 MIT BarnOwl 1.6
Not Vulnerable:	MIT BarnOwl 1.6.2

BarnOwl 'libzephyr' Multiple Remote Denial of Service Vulnerabilities

BarnOwl is prone to multiple remote denial-of-service vulnerabilities because it fails to properly sanitize user-supplied input.

Attackers can exploit these issues to cause the application to crash, denying service to legitimate users. Remote code execution may also be possible.

Versions prior to BarnOwl 1.6.2 are vulnerable.

BarnOwl 'libzephyr' Multiple Remote Denial of Service Vulnerabilities

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

BarnOwl 'libzephyr' Multiple Remote Denial of Service Vulnerabilities

Solution:
Updates are available. Please see the references for more information.

BarnOwl 'libzephyr' Multiple Remote Denial of Service Vulnerabilities

References:

• BarnOwl 1.6.2 Release Notes (MIT)
  
• BarnOwl Changlog (GitHub )
  
• BarnOwl Homepage (MIT)