Date: Wed, 07 May 2014 12:30:41 -0600 From: Kurt Seifried <kseifried@...hat.com> To: Open Source Security <oss-security@...ts.openwall.com> Subject: A note on DBus and the Hash DOS -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 So many years ago some hash dos stuff happened. I checked into a variety of programs using embedded copies of various things like XML/etc. Also other programs that use hashing for stuff, one of which is DBus. The bad news: DBus has a vulnerable hash implementation The good news: there doesn't appear to be many (any?) ways to inject data easily to trigger this vulnerability. So I don't think this needs a CVE since it isn't really trigger-able, but posted this more as a reminder that hash DoS vulns are probably still lurking in various places. With thanks to Florian Weimer of the Red Hat Product Security Team who did the actual code audit bits. - -- Kurt Seifried Red Hat Security Response Team (SRT) PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJTanvQAAoJEBYNRVNeJnmTLz0P/2cxxh5dWawa5zBBDR0WFjrd AK3QCgf+YRjbzyuUcL+mo7Vu1THbdR+EmyLih8SBmhm4hjwf6Q/ZZThKnFA6+9MO 3eYIxkJAHuHNG0RILOmxW7LVrWMW3VLoldaFlC1W2dBEgJMXacTUE31HL2PUFQ5R 44LYYtmGhSyHZOUjCasHmvxbqm37ktzXVxLUi2TVyKZVMYgJ8BPDxmaZTiqGI7/y 03908LSI6sasxLYMU8SFj7AY9CcvL/cCpednnoOevul3AdjNeUGo89rAiNCwys4K svoh4updd+QFw6frxpGkY6W8BINIz+Pd2OeXyoeq9Dl+7SWsmyJmvij2ZUahjEQo cGwJ6DvY1UvxUMj2hrRGwDuAaFvldgi7vLoOXSQa6Kp36ittCdj2aB4vpi71dxa6 pmpeSUvvLcSxLiDiYPMYgUUjF9M14qA3PcAzp9rU4e7CgqpqTxfEGqN41CSG/BpF F3mVPhhzoHL4bH4EwLgW0a04kFxQnU8cvsLXxuHlQKjSrbISadqFKLk4HLNyy+cu ixEvVYqqBRBwgCc+ZL+TvGmzefgngxaXsXXw1O8Z3h5WQer1+mMx9A3cEvS7MQ6n gd92IjiJg5rE4SdCCdnmQsmD34GUWJN2OlUJ9+uGNy4lLgu23LWgFRZcgeMAVaEy 7LHGWbwB0IUvQmRC/S6z =9i7N -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ