pwlib, as used by Ekiga 2.0.5 and possibly other products, allows remote attackers to cause a denial of service (application crash) via a long argument to the PString::vsprintf function, related to a "memory management flaw". NOTE: this issue was originally reported as being in the SIPURL::GetHostAddress function in Ekiga (formerly GnomeMeeting).

In Scientific Linux 5, the Ekiga teleconferencing application uses PWLib.

A memory management flaw was discovered in PWLib. An attacker could use this flaw to crash an application, such as Ekiga, which is linked with pwlib (CVE-2007-4897).

Updated pwlib packages that fix a security issue are now available for Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

PWLib is a library used to support cross-platform applications.

In Red Hat Enterprise Linux 5, the Ekiga teleconferencing application uses PWLib.

A memory management flaw was discovered in PWLib. An attacker could use this flaw to crash an application, such as Ekiga, which is linked with pwlib (CVE-2007-4897).

Users should upgrade to these updated packages which contain a backported patch to correct this issue.

Jose Miguel Esparza discovered that pwlib did not correctly handle large string lengths. A remote attacker could send specially crafted packets to applications linked against pwlib (e.g. Ekiga) causing them to crash, leading to a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A memory management flaw was discovered in PWLib, that an attacker could use to crash an application linked with it, such as Ekiga.

Updated packages have been patched to prevent these issues.

ID	Name	Product	Family	Severity
60265	Scientific Linux Security Update : pwlib on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
43653	CentOS 5 : pwlib (CESA-2007:0932)	Nessus	CentOS Local Security Checks	medium
29917	Ubuntu 6.06 LTS / 6.10 / 7.04 / 7.10 : pwlib vulnerability (USN-561-1)	Nessus	Ubuntu Local Security Checks	medium
27624	Mandrake Linux Security Advisory : pwlib (MDKSA-2007:206)	Nessus	Mandriva Local Security Checks	medium
26953	RHEL 5 : pwlib (RHSA-2007:0932)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2007-4897

high

Tenable Plugins

medium

medium

medium

medium

medium