Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 7 May 2012 15:59:22 +0200
From: Sebastian Krahmer <krahmer@...e.de>
To: oss-security@...ts.openwall.com
Subject: Re: connman heads up / CVE requests

Hi,

Thanks for disassembling my mail :)


> 1) Conman doesn't check for the origin of netlink messages
>    (from https://bugzilla.novell.com/show_bug.cgi?id=715172#c4)
> 
>    with patches:
>    [1a] 
> http://git.kernel.org/?p=network/connman/connman.git;a=commit;h=c1b968984212b46bea1330f5ae029507b9bfded9
>    [1b] 
> http://git.kernel.org/?p=network/connman/connman.git;a=commit;h=b0ec6eb4466acc57a9ea8be52c17b674b6ea0618

Yes.

> 
> 2) Check hostname validity prior setting the hostname in loopback
>    plug-in:
>    (from https://bugzilla.novell.com/show_bug.cgi?id=715172#c4)
> 
>    with patches:
>    [2a] 
> http://git.kernel.org/?p=network/connman/connman.git;a=commit;h=26ace5c59f790bce0f1988b88874c6f2c480fd5a
>    [2b] 
> http://git.kernel.org/?p=network/connman/connman.git;a=commit;h=a5f540db7354b76bcabd0a05d8eb8ba2bff4e911

Yes. The severity of this is quite high, its a default remote root exploit, as
connman is requesting hostname per dhcp by default and not checking for
shell escapes.
(I did not check whether they clean any other strings that could appear
and could contain newlines etc. when its written to a config file)

> 
> 3) DHCPv6 option parsing vulnerable to DoS (endless loop):
>    (from https://bugzilla.novell.com/show_bug.cgi?id=715172#c9)
> 
>    with patches:
>    There doesn't seem to be upstream patches for this yet.

I think its this:
http://lists.connman.net/pipermail/connman/2012-May/009473.html


> 
> 4) Check vpnc options for validity prior saving them:
>    (from https://bugzilla.novell.com/show_bug.cgi?id=715172#c10):

AFAIK there is no patch for it yet. Upstream needs to verify/confirm these,
but I think its a real bug that lets you overwrite files.

Sebastian

-- 

~ perl self.pl
~ $_='print"\$_=\47$_\47;eval"';eval
~ krahmer@...e.de - SuSE Security Team

---
SUSE LINUX Products GmbH,
GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer, HRB 16746 (AG Nürnberg)
Maxfeldstraße 5
90409 Nürnberg
Germany

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ