Date: Sat, 25 Aug 2012 10:29:59 +0200 From: Jan Willamowius <jan@...lamowius.de> To: oss-security@...ts.openwall.com, jan@...lamowius.de Subject: Re: information request on security bug fix in GNU Gatekeeper 3.1 Hi Raphael, I was planning to give people a few days to update before releasing detailed information. But you are right, the possibility to create an unlimited number of connections each with its own thread handling it is the issue that creates an easy possibility for a DOS attack. Regards, Jan -- Jan Willamowius, Founder of the GNU Gatekeeper Project EMail : jan@...lamowius.de Website: http://www.gnugk.org Support: http://www.willamowius.com/gnugk-support.html Raphael Geissert wrote: > Hi Jan, > > On the announcement of release 3.1 of GNU Gatekeeper there's a mention of > a security bug fix. > Could you please shed some light on the security issue? is it related to the > status port connection limit feature that was recently added in  and > similar? > > Thanks in advance. > > Found via secunia SA50343  > > http://www.gnugk.org/gnugk-3.1.html > http://openh323gk.cvs.sourceforge.net/viewvc/openh323gk/openh323gk/GkStatus.cxx?r1=1.132&r2=1.133 > http://secunia.com/advisories/50343/ > > Kind regards, > -- > Raphael Geissert - Debian Developer > www.debian.org - get.debian.net >
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ