Description
connection.c in Bip before 0.8.9 does not properly close sockets, which allows remote attackers to cause a denial of service (file descriptor consumption and crash) via multiple failed SSL handshakes, a different vulnerability than CVE-2013-4550. NOTE: this issue was SPLIT from CVE-2013-4550 because it is a different type of issue.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | bip | 0.8.9-1 | — |
| Debian 13 | bip | 0.8.9-1 | — |
| Debian 12 | bip | 0.8.9-1 | — |
References
- FEDORA-2013-21060 vendor-advisory
- https://projects.duckcorp.org/issues/261
- https://projects.duckcorp.org/versions/13
- FEDORA-2013-21006 vendor-advisory
- FEDORA-2013-21018 vendor-advisory
- [oss-security] 20140102 Re: Duplicated CVE assignment for bip mailing-list