Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sat, 25 Aug 2012 10:29:59 +0200
From: Jan Willamowius <jan@...lamowius.de>
To: oss-security@...ts.openwall.com, jan@...lamowius.de
Subject: Re: information request on security bug fix in GNU Gatekeeper 3.1

Hi Raphael,

I was planning to give people a few days to update before releasing
detailed information.

But you are right, the possibility to create an unlimited number of
connections each with its own thread handling it is the issue that
creates an easy possibility for a DOS attack.

Regards,
Jan

-- 
Jan Willamowius, Founder of the GNU Gatekeeper Project
EMail  : jan@...lamowius.de
Website: http://www.gnugk.org
Support: http://www.willamowius.com/gnugk-support.html


Raphael Geissert wrote:
> Hi Jan,
> 
> On the announcement of release 3.1 of GNU Gatekeeper[1] there's a mention of 
> a security bug fix.
> Could you please shed some light on the security issue? is it related to the 
> status port connection limit feature that was recently added in [2] and 
> similar?
> 
> Thanks in advance.
> 
> Found via secunia SA50343 [3]
> 
> [1]http://www.gnugk.org/gnugk-3.1.html
> [2]http://openh323gk.cvs.sourceforge.net/viewvc/openh323gk/openh323gk/GkStatus.cxx?r1=1.132&r2=1.133
> [3]http://secunia.com/advisories/50343/
> 
> Kind regards,
> -- 
> Raphael Geissert - Debian Developer
> www.debian.org - get.debian.net
> 

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ