[ GLSA 201311-12 ] Open DC Hub: Arbitrary code execution

[GLSA]

Gentoo Linux Security Advisory

Title: Open DC Hub: Arbitrary code execution (GLSA 201311-12)
Severity: normal
Exploitable: remote
Date: November 20, 2013
Bug(s): #314551
ID: 201311-12

Synopsis

A vulnerability in Open DC Hub could result in execution of
arbitrary code.


Background

Open DC Hub is the hub software for the Direct Connect file sharing
network.


Affected Packages

Package: net-p2p/opendchub
Vulnerable: < 0.8.2
Unaffected: >= 0.8.2
Architectures: All supported architectures


Description

A stack-based buffer overflow flaw has been discovered in the way Open
DC Hub sanitized content of a user’s MyINFO message.


Impact

A remote authenticated user may be able to execute arbitrary code or
cause a Denial of Service condition via specially crafted MyINFO message.


Workaround

There is no known workaround at this time.

Resolution

All Open DC Hub users should upgrade to the latest version: