CVE-2014-3619 The __socket_proto_state_machine function in GlusterFS 3.5 allows remote attackers to cause a denial of service (infinite loop) via a "00000000" fragment header.
MediumCVSS 5.0
EPSS 2.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The __socket_proto_state_machine function in GlusterFS 3.5 allows remote attackers to cause a denial of service (infinite loop) via a "00000000" fragment header.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/glusterfs(Debian:12) | < 3.5.2-2 | 3.5.2-2 |
| debian/glusterfs(Debian:13) | < 3.5.2-2 | 3.5.2-2 |
| debian/glusterfs(Debian:14) | < 3.5.2-2 | 3.5.2-2 |
| opensuse | = 13.1 | No fix listed |
| glusterfs | = 3.5 | No fix listed |
References
- Debian Security Tracker CVE-2014-3619 vendor-advisory
- advisories.mageia.org
- openSUSE-SU-2015:0473 vendor-advisory
- openSUSE-SU-2015:0528 vendor-advisory
- review.gluster.org
- MDVSA-2015:211 vendor-advisory
- bugzilla.redhat.com
- bugs.debian.org issue-tracking