oss-security - Re: CVE request: setrlimit can be avoided (Linux less than 2.6.22)

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / community lists wiki CVSweb mirrors signatures
bringing security into open environments

Order Openwall GNU/*/Linux 2.0 on a CD with delivery worldwide

[<prev] [next>] [<thread-prev] [month] [year] [list]

Date: Wed, 12 Mar 2008 12:16:20 -0400 (EDT)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: oss-security@...ts.openwall.com
Subject: Re: CVE request: setrlimit can be avoided (Linux less
 than 2.6.22)

On Tue, 11 Mar 2008, Kees Cook wrote:

> This rlimit-avoiding bug probably needs a CVE associated with it.  Users
> could avoid RLIMIT_CPU by setting it to "0".  The fixes in 2.6.17 did
> not actually fix the problem.

Use CVE-2008-1294 - will be filled in later.

- Steve

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.