oss-security - Re: connman heads up / CVE requests

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Mon, 07 May 2012 15:08:17 +0200
From: Jan Lieskovsky <jlieskov@...hat.com>
To: Sebastian Krahmer <krahmer@...e.de>
CC: oss-security@...ts.openwall.com
Subject: Re: connman heads up / CVE requests

Hi Sebastian,

On 05/07/2012 10:27 AM, Sebastian Krahmer wrote:
> Hi,
>
> I reported several issues

Just to confirm, you have meant four issues:
1) Conman doesn't check for the origin of netlink messages
    (from https://bugzilla.novell.com/show_bug.cgi?id=715172#c4)

    with patches:
    [1a] 
http://git.kernel.org/?p=network/connman/connman.git;a=commit;h=c1b968984212b46bea1330f5ae029507b9bfded9
    [1b] 
http://git.kernel.org/?p=network/connman/connman.git;a=commit;h=b0ec6eb4466acc57a9ea8be52c17b674b6ea0618

2) Check hostname validity prior setting the hostname in loopback
    plug-in:
    (from https://bugzilla.novell.com/show_bug.cgi?id=715172#c4)

    with patches:
    [2a] 
http://git.kernel.org/?p=network/connman/connman.git;a=commit;h=26ace5c59f790bce0f1988b88874c6f2c480fd5a
    [2b] 
http://git.kernel.org/?p=network/connman/connman.git;a=commit;h=a5f540db7354b76bcabd0a05d8eb8ba2bff4e911

3) DHCPv6 option parsing vulnerable to DoS (endless loop):
    (from https://bugzilla.novell.com/show_bug.cgi?id=715172#c9)

    with patches:
    There doesn't seem to be upstream patches for this yet.

4) Check vpnc options for validity prior saving them:
    (from https://bugzilla.novell.com/show_bug.cgi?id=715172#c10):

    with patches:
    [4a] 
http://git.kernel.org/?p=network/connman/connman.git;a=commit;h=651b5920aceb10a5c53424a9723d9365ba612316

> to the connman developers last week and it
> seems they made patches for most of them which were
> posted on their mailing list. The one that I am missing is related
> to the GKeyFile/VPN settings storage.

So yet another patch is needed to correct this except [4a]? Or is
[4a] unrelated to this?

> I did not review the
> patches itself, except checking them slightly.
> The bug report is here:
>
> https://bugzilla.novell.com/show_bug.cgi?id=715172
>
> It was not a full review, so some parts remain unchecked.
>
> Some dists seem to ship it and before it goes the wicd way,
> I'd rather ask for CVE's myself.

For now could you confirm count of the issues and links to
patches, where appropriate? (this will be needed anyway for
purpose of CVE request)

Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Response Team

>
> Sebastian
>

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.