oss-security - Re: vsftpd CVE-2007-5962 (Red Hat / Fedora specific)

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed, 21 May 2008 22:23:24 -0800
From: Jonathan Smith <smithj@...ethemallocs.com>
To: oss-security@...ts.openwall.com
CC: chris@...ry.beasts.org
Subject: Re: vsftpd CVE-2007-5962 (Red Hat / Fedora specific)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Steven M. Christey wrote:
| On Wed, 21 May 2008, Josh Bressers wrote:
|
|> The leak is CVE-2007-5962.  deny_hosts not working did not get a CVE id.
|
| Should it?  If an admin configures deny_hosts in some fashion that vsftpd
| doesn't implement correctly, that might be worthy of a CVE.

I don't think rPath treated it as such when we originally added the
patch, though. It would probably be worth adding it to our other branch
and pushing it upstream as a security issue.

So, yeah, I'd say it needs a CVE. Thanks.

	smithj

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.9 (GNU/Linux)

iEYEARECAAYFAkg1EVwACgkQCG91qXPaRel/yQCgrCYbog7T8HMCP0AmpY/oMGWg
kGwAnAlkIiFG7LkTuE4TxKaN+8rBv72p
=vEXX
-----END PGP SIGNATURE-----

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.