1. Gentoo Linux Security Advisory
| Advisory Reference | GLSA 200904-13 / ventrilo-server-bin |
| Release Date | April 14, 2009 |
| Latest Revision | April 14, 2009: 01 |
| Impact | normal |
| Exploitable | remote |
| Package | Vulnerable versions | Unaffected versions | Architecture(s) |
| media-sound/ventrilo-server-bin | < 3.0.3 | >= 3.0.3 | All supported architectures |
Related bugreports: #234819
A vulnerability has been discovered in Ventrilo, allowing for a Denial of Service.
Ventrilo is a Voice over IP group communication server.
Luigi Auriemma reported a NULL pointer dereference in Ventrilo when processing packets with an invalid version number followed by another packet.
A remote attacker could send specially crafted packets to the server, resulting in a crash.
There is no known workaround at this time.
All Ventrilo users should upgrade to the latest version:
Code Listing 3.1: Resolution |
# emerge --sync # emerge --ask --oneshot --verbose ">=media-sound/ventrilo-server-bin-3.0.3" |