[<prev] [next>] [day] [month] [year] [list]
Date: Mon, 21 Oct 2013 20:42:46 +0400
From: Solar Designer <solar@...nwall.com>
To: announce@...ts.openwall.com
Subject: [openwall-announce] scanlogd 2.2.7, popa3d 1.0.3, msulogin 1.0
Hi,
I've just released minor updates of scanlogd, popa3d, and msulogin.
Most of the corresponding changes have been in Owl for a long while, but
I did not get around to making the proper releases until today.
scanlogd 2.2.7 is available from the usual location:
http://www.openwall.com/scanlogd/
In this version, I fixed an off-by-one bug in the safety check against
SCAN_MAX_COUNT. In properly configured builds of scanlogd,
SCAN_WEIGHT_THRESHOLD is such that it's always hit before SCAN_MAX_COUNT
would be hit, so this bug did not matter for those. However, other
projects reusing this code could make these settings runtime
(mis)configurable, thereby exposing the bug. Luckily, in scanlogd
itself, if it is misconfigured like this, a port number written right
beyond the array limit would overwrite relatively unimportant data only
(part of the same struct), which could be directly provided/spoofed by
the remote system anyway. However, in other projects reusing code from
scanlogd this could be different. Thus, this change is unimportant for
scanlogd itself, but it may be a critical security fix for other
projects reusing this code. I'd like to thank Florian Westphal for
reporting this bug.
popa3d 1.0.3 and msulogin 1.0 are also where you'd expect them:
http://www.openwall.com/popa3d/
http://www.openwall.com/msulogin/
These revisions will handle possible NULL returns from crypt(3)
gracefully, and msulogin 1.0 will also handle possible failure of
tcgetattr(3) well.
While at it, I've unified the license for all three of these projects to
be the heavily cut-down BSD license that we've been using lately.
Alexander
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
