GLSA-200803-20 : International Components for Unicode: Multiple vulnerabilities

This script is Copyright (C) 2008-2014 Tenable Network Security, Inc.


Synopsis :

The remote Gentoo host is missing one or more security-related
patches.

Description :

The remote host is affected by the vulnerability described in GLSA-200803-20
(International Components for Unicode: Multiple vulnerabilities)

Will Drewry (Google Security) reported a vulnerability in the regular
expression engine when using back references to capture \\0 characters
(CVE-2007-4770). He also found that the backtracking stack size is not
limited, possibly allowing for a heap-based buffer overflow
(CVE-2007-4771).

Impact :

A remote attacker could submit specially crafted regular expressions to
an application using the library, possibly resulting in the remote
execution of arbitrary code with the privileges of the user running the
application or a Denial of Service.

Workaround :

There is no known workaround at this time.

See also :

http://www.gentoo.org/security/en/glsa/glsa-200803-20.xml

Solution :

All International Components for Unicode users should upgrade to the
latest version:
# emerge --sync
# emerge --ask --oneshot --verbose '>=dev-libs/icu-3.8.1-r1'

Risk factor :

High / CVSS Base Score : 9.3
(CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C)

Family: Gentoo Local Security Checks

Nessus Plugin ID: 31446 (gentoo_GLSA-200803-20.nasl)

Bugtraq ID:

CVE ID: CVE-2007-4770
CVE-2007-4771