oss-security - Re: update on CVE-2008-5718

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / news community lists wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [<thread-prev] [thread-next>] [month] [year] [list]

Date: Wed, 14 Jan 2009 09:21:57 +0100
From: Thomas Biege <thomas@...e.de>
To: oss-security@...ts.openwall.com
Subject: Re: update on CVE-2008-5718

Hello Nico,

On Wed, Jan 14, 2009 at 12:32:07AM +0100, Nico Golde wrote:
> Hi,
> I just did a security update for CVE-2008-5718 and since the 
> description is not really verbose I thought I'd share what I 
> found in case anyone else is working on that.
...
> Cheers
> Nico
> P.S. The patch I used can be found on:
> http://people.debian.org/~nion/nmu-diff/netatalk-2.0.3-11_2.0.3-11+lenny1.patch

I am not very happy with the patch because it just filters a handful of
characters, a better solution would be to replace popen().
(I mentioned this on the netatalk-devel ML but got no answer so far.)



-- 
Bye,
     Thomas
-- 
 Thomas Biege <thomas@...e.de>, SUSE LINUX, Security Support & Auditing
 SUSE LINUX Products GmbH, GF: Markus Rex, HRB 16746 (AG Nuernberg)
-- 
           Hamming's Motto:
           The purpose of computing is insight, not numbers.
                                -- Richard W. Hamming

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.