Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 14 Jul 2015 22:46:03 +0200
From: Agostino Sarubbo <ago@...too.org>
To: oss-security@...ts.openwall.com
Cc: Seth Arnold <seth.arnold@...onical.com>, cve-assign@...re.org
Subject: Re: siege: off-by-one in load_conf()

On Tuesday 14 July 2015 13:11:52 Seth Arnold wrote:
> Does load_conf() process any information from any untrusted sources? 
Has
> Siege processed any data from the network at this point? 
I don't know exactly, ask upstream.

> This sounds like a regular bug rather than a security boundary, unless 
I've > misunderstood the application.

Everyone has a security concept of the off-by-one. This is the reason 
because I mentioned to assign a cve if for mitre is a valid request.

I filed the bug because it is the case of CWE-193.
Feel free to see it as a non-security impact major than a DoS/segfault.

-- 
Agostino Sarubbo
Gentoo Linux Developer

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ