RHEL 2.1 : stunnel (RHSA-2003:223)

This script is Copyright (C) 2004-2014 Tenable Network Security, Inc.


Synopsis :

The remote Red Hat host is missing a security update.

Description :

Updated stunnel packages are now available. These updates correct a
potential vulnerability in stunnel's signal handling.

Stunnel is a wrapper for network connections. It can be used to tunnel
an unencrypted network connection over a secure connection (encrypted
using SSL or TLS) or to provide a secure means of connecting to
services that do not natively support encryption.

When configured to listen for incoming connections (instead of being
invoked by xinetd), stunnel can be configured to either start a thread
or a child process to handle each new connection. If Stunnel is
configured to start a new child process to handle each connection, it
will receive a SIGCHLD signal when that child exits.

Stunnel versions prior to 4.04 would perform tasks in the SIGCHLD
signal handler which, if interrupted by another SIGCHLD signal, could
be unsafe. This could lead to a denial of service.

All users are urged to upgrade to these errata packages, which modify
stunnel's signal handler so that it is not vulnerable to this issue.

NOTE: After upgrading, any instances of stunnel configured to run in
daemon mode should be restarted, and any active network connections
that are currently being serviced by stunnel should be terminated and
reestablished.

See also :

https://www.redhat.com/security/data/cve/CVE-2002-1563.html
http://marc.info/?l=stunnel-users&m=103600188215117
http://rhn.redhat.com/errata/RHSA-2003-223.html

Solution :

Update the affected stunnel package.

Risk factor :

Low / CVSS Base Score : 1.2
(CVSS2#AV:L/AC:H/Au:N/C:N/I:N/A:P)

Family: Red Hat Local Security Checks

Nessus Plugin ID: 12406 ()

Bugtraq ID:

CVE ID: CVE-2002-1563