Security
Security
A vulnerability has been discovered in Ventrilo, allowing for a Denial of Service.
| Package | media-sound/ventrilo-server-bin on all architectures |
|---|---|
| Affected versions | < 3.0.3 |
| Unaffected versions | >= 3.0.3 |
Ventrilo is a Voice over IP group communication server.
Luigi Auriemma reported a NULL pointer dereference in Ventrilo when processing packets with an invalid version number followed by another packet.
A remote attacker could send specially crafted packets to the server, resulting in a crash.
There is no known workaround at this time.
All Ventrilo users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-sound/ventrilo-server-bin-3.0.3"
Release date
April 14, 2009
Latest revision
April 14, 2009: 01
Severity
normal
Exploitable
remote
Bugzilla entries