fetchnews in leafnode 1.9.47 and earlier allows remote attackers to cause a denial of service (process hang) via an empty NNTP news article with missing mandatory headers.

According to its version number, the remote Leafnode NNTP server is vulnerable to a denial of service attack.  Specifically, it may hang without consuming CPU when attempting to read a news article with missing mandatory headers.  This means that news will not be updated until the fetchnews process is killed. 

Note that Nessus did not actually test for the flaw but instead has relied on the version in Leafnode's banner so this may be a false positive.

When a downloaded news article ends prematurely, i. e. when the server sends [CR]LF.[CR]LF before sending a blank line, fetchnews may wait indefinitely for data that never arrives. Workaround: configure 'minlines=1' (or use a bigger value) in the configuration file. Found by Toni Viemero.

A number of vulnerabilities in the leafnode NNTP server package have been found :

A vulnerability in the fetchnews program that could under some circumstances cause a wait for input that never arrives, which in turn would cause fetchnews to hang (CVE-2004-2068).

Two vulnerabilities in the fetchnews program can cause fetchnews to crash when the upstream server closes the connection and leafnode is receiving an article header or an article body, which prevent leafnode from querying other servers that are listed after that particular server in the configuration file (CVE-2005-1453).

Finally, another vulnerability in the fetchnews program could also cuase a wait for input that never arrives, causing fetchnews to hang (CVE-2005-1911).

The updated packages have been patched to correct this problem.

The remote host is running the LeafNode NNTP server. The version of LeafNode that is installed is vulnerable to a remote Denial of Service (DoS) attack.  When an upstream NNTP server requests a header and then allows the connection to time out, the LeafNode NNTP server fails.  Successful exploitation would result in a loss of availability.

ID	Name	Product	Family	Severity
42260	leafnode fetchnews DoS	Nessus	Misc.	medium
37223	FreeBSD : leafnode fetchnews denial-of-service triggered by truncated transmission (a051a4ec-3aa1-4dd1-9bdc-a61eb5700153)	Nessus	FreeBSD Local Security Checks	medium
18676	Mandrake Linux Security Advisory : leafnode (MDKSA-2005:114)	Nessus	Mandriva Local Security Checks	medium
3011	Leafnode < 1.11.3 TCP Timeout DoS	Nessus Network Monitor	Generic	medium

Detections

Analytics

CVE-2004-2068

high

Tenable Plugins

medium

medium

medium

medium