[ GLSA 200903-22 ] Ganglia: Execution of arbitrary code

[GLSA]

Gentoo Linux Security Advisory

Title: Ganglia: Execution of arbitrary code (GLSA 200903-22)
Severity: high
Exploitable: remote
Date: March 10, 2009
Bug(s): #255366
ID: 200903-22

Synopsis


A buffer-overflow in Ganglia's gmetad might lead to the execution of
arbitrary code.


Background


Ganglia is a scalable distributed monitoring system for clusters and
grids.


Affected Packages

Package: sys-cluster/ganglia
Vulnerable: < 3.1.1-r2
Unaffected: >= 3.1.1-r2
Architectures: All supported architectures


Description


Spike Spiegel reported a stack-based buffer overflow in the
process_path() function when processing overly long pathnames in
gmetad/server.c.


Impact


A remote attacker could send a specially crafted request to the gmetad
service leading to the execution of arbitrary code or a Denial of
Service.


Workaround


There is no known workaround at this time.


Resolution


All Ganglia users should upgrade to the latest version: