[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 12 Oct 2011 14:09:32 +0400
From: Vasiliy Kulikov <segoon@...nwall.com>
To: Reuben Hawkins <reubenhwk@...il.com>
Cc: oss-security@...ts.openwall.com
Subject: Re: radvd 1.8.2 released with security fixes
On Tue, Oct 11, 2011 at 23:26 -0700, Reuben Hawkins wrote:
> On Sat, Oct 8, 2011 at 9:55 AM, Vasiliy Kulikov <segoon@...nwall.com> wrote:
> > Crap, thank you for noticing it, guys. The fix should be:
> >
> > https://github.com/reubenhwk/radvd/commit/7a1471b62da88373e8f4209d503307c5d841b81f
> >
> > Now, "", "..", "." and filenames with "/" inside are denied.
In case someone didn't fully track the discussion thread, I'll sum it up -
In the original patch the variable name is typoed/confused - the check
should be against "iface" instead of "name". The check against "name"
is totally wrong as it checks a static hint string, which always passes
the check.
The confused blacklisted iface set is a bug, but not a security bug;
the confused variable name is indeed a security bug (not a flaw per se,
but it greatly weakens the privsep model).
Thanks to Solar Designer for pointing out that this thing is probably
not clear to everybody.
--
Vasiliy Kulikov
http://www.openwall.com - bringing security into open computing environments
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
