Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 7 May 2012 15:59:22 +0200
From: Sebastian Krahmer <>
Subject: Re: connman heads up / CVE requests


Thanks for disassembling my mail :)

> 1) Conman doesn't check for the origin of netlink messages
>    (from
>    with patches:
>    [1a] 
>    [1b] 


> 2) Check hostname validity prior setting the hostname in loopback
>    plug-in:
>    (from
>    with patches:
>    [2a] 
>    [2b] 

Yes. The severity of this is quite high, its a default remote root exploit, as
connman is requesting hostname per dhcp by default and not checking for
shell escapes.
(I did not check whether they clean any other strings that could appear
and could contain newlines etc. when its written to a config file)

> 3) DHCPv6 option parsing vulnerable to DoS (endless loop):
>    (from
>    with patches:
>    There doesn't seem to be upstream patches for this yet.

I think its this:

> 4) Check vpnc options for validity prior saving them:
>    (from

AFAIK there is no patch for it yet. Upstream needs to verify/confirm these,
but I think its a real bug that lets you overwrite files.



~ perl
~ $_='print"\$_=\47$_\47;eval"';eval
~ - SuSE Security Team

SUSE LINUX Products GmbH,
GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer, HRB 16746 (AG Nürnberg)
Maxfeldstraße 5
90409 Nürnberg

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ