Debian Security Advisory
DSA-2964-1 iodine -- security update
- Date Reported:
- 21 Jun 2014
- Affected Packages:
- iodine
- Vulnerable:
- Yes
- Security database references:
- In the Debian bugtracking system: Bug 751834.
In Mitre's CVE dictionary: CVE-2014-4168. - More information:
-
Oscar Reparaz discovered an authentication bypass vulnerability in iodine, a tool for tunneling IPv4 data through a DNS server. A remote attacker could provoke a server to accept the rest of the setup or also network traffic by exploiting this flaw.
For the stable distribution (wheezy), this problem has been fixed in version 0.6.0~rc1-12+deb7u1.
For the testing distribution (jessie), this problem has been fixed in version 0.6.0~rc1-19.
For the unstable distribution (sid), this problem has been fixed in version 0.6.0~rc1-19.
We recommend that you upgrade your iodine packages.