Pen netlogging Buffer Overflow Vulnerability

Bugtraq ID:	5152
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 03 2002 12:00AM
Updated:	Jul 03 2002 12:00AM
Credit:	Published in a Pen changelog.
Vulnerable:	Pen Pen 0.9.2 Pen Pen 0.9.1
Not Vulnerable:	Pen Pen 0.9.3

Pen netlogging Buffer Overflow Vulnerability

Pen is a load balancing tool for TCP-based protocols such as HTTP. It includes support for remote logging to an included server. Pen is developed and maintained by Ulric Eriksson.

A buffer overflow has been discovered in the netlog() function of Pen. An attacker may be able to exploit this vulnerability through the manipulation of data included in log messages, possibly resulting in the execution of arbitrary code.

Pen netlogging Buffer Overflow Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Pen netlogging Buffer Overflow Vulnerability

Solution:
Pen 0.9.3 is not affected by this issue:


Pen Pen 0.9.1

• Pen pen-0.9.3
  ftp://siag.nu/pub/pen/pen-0.9.3.tar.gz

Pen Pen 0.9.2

• Pen pen-0.9.3
  ftp://siag.nu/pub/pen/pen-0.9.3.tar.gz

Pen netlogging Buffer Overflow Vulnerability

References:

• Pen Homepage (Ulric Eriksson )