From 41e0e86c2039d34c93edc4f43b90dc19a8375d04 Mon Sep 17 00:00:00 2001 From: Remko Lodder Date: Tue, 27 Jun 2006 19:55:04 +0000 Subject: [PATCH] Document hashcash -- heap overflow vulnerability. --- security/vuxml/vuln.xml | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index daed4d137ff2..af97bfe61c99 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -34,6 +34,38 @@ Note: Please add new entries to the beginning of this file. --> + + hashcash -- heap overflow vulnerability + + + hashcash + 1.22 + + + + +

Andreas Seltenreich reports that hashcash is prone to a heap + overflow vulnerability. This vulnerability is caused by + improper checking of memory allocations within the + "array_push()" function. An attacker could trigger this + vulnerability by passing a lot of "-r" or "-j" flags from + the command line, this only applies when the application is + configured to allow command line options, or by passing a lot + of resource names when the application was started with the + "-m" flag set. This could lead to a Denial or Service or + could allow remote access to the targeted system.

+ + + + http://secunia.com/advisories/20800/ + http://www.hashcash.org/source/CHANGELOG + + + 2006-06-27 + 2006-06-27 + + + gnupg -- user id integer overflow vulnerability