28 Feb 2010 20:22
New siproxd release 0.8.0
This release fixes CVE-2009-3736, includes a better handling of symmetric RTP and provides support for the UPDATE method. Everybody, please move ahead to this version. CVE-2009-3736: Local privilege escalation: Siproxd does include a so called convenience copy of libldtl. Recently a local privilege escalation issue has been found and reported: "ltdl.c in libltdl in GNU Libtool 1.5.x, and 2.2.6 before 2.2.6b, attempts to open a .la file in the current working directory, which allows local users to gain privileges via a Trojan horse file." Find out more about CVE-2009-3736 from MITRE CVE: <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3736> Two measures have been implemented with siproxd: - Siproxd does use a system provided libltdl, if available. The included convenienve copy will only be used as a fallback if no libltdl is provided on the building host. - The included convenience copy in the siproxd package has been updated to a version that has this issue fixed. Release Notes for siproxd-0.8.0 =============================== Major changes since 0.7.2: - CVE-2009-3736: use libltdl on host if existing and fall back using convenienve libltdl (with a config warning) - updated libtool version(Continue reading)
RSS Feed