Description
The init_nss_hash function in exec/totemcrypto.c in Corosync 2.0 before 2.3 does not properly initialize the HMAC key, which allows remote attackers to cause a denial of service (crash) via a crafted packet.
References (5)
Core 5
Core References
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/52037
Exploit, Patch x_refsource_confirm
https://github.com/corosync/corosync/commit/b3f456a8ceefac6e9f2e9acc2ea0c159d412b595
Mailing List mailing-list
x_refsource_mlist
http://seclists.org/oss-sec/2013/q1/213
Mailing List mailing-list
x_refsource_mlist
http://seclists.org/oss-sec/2013/q1/214
Mailing List mailing-list
x_refsource_mlist
http://seclists.org/oss-sec/2013/q1/212
Scores
EPSS
0.0308
EPSS Percentile
86.1%
Details
Status
published
Products (7)
corosync/corosync
2.0.0
corosync/corosync
2.0.1
corosync/corosync
2.0.2
corosync/corosync
2.0.3
corosync/corosync
2.1.0
corosync/corosync
2.1.1
corosync/corosync
2.2.0
Published
Jun 06, 2014
Tracked Since
Feb 18, 2026