Date: Mon, 21 Oct 2013 20:42:46 +0400 From: Solar Designer <solar@...nwall.com> To: announce@...ts.openwall.com Subject: [openwall-announce] scanlogd 2.2.7, popa3d 1.0.3, msulogin 1.0 Hi, I've just released minor updates of scanlogd, popa3d, and msulogin. Most of the corresponding changes have been in Owl for a long while, but I did not get around to making the proper releases until today. scanlogd 2.2.7 is available from the usual location: http://www.openwall.com/scanlogd/ In this version, I fixed an off-by-one bug in the safety check against SCAN_MAX_COUNT. In properly configured builds of scanlogd, SCAN_WEIGHT_THRESHOLD is such that it's always hit before SCAN_MAX_COUNT would be hit, so this bug did not matter for those. However, other projects reusing this code could make these settings runtime (mis)configurable, thereby exposing the bug. Luckily, in scanlogd itself, if it is misconfigured like this, a port number written right beyond the array limit would overwrite relatively unimportant data only (part of the same struct), which could be directly provided/spoofed by the remote system anyway. However, in other projects reusing code from scanlogd this could be different. Thus, this change is unimportant for scanlogd itself, but it may be a critical security fix for other projects reusing this code. I'd like to thank Florian Westphal for reporting this bug. popa3d 1.0.3 and msulogin 1.0 are also where you'd expect them: http://www.openwall.com/popa3d/ http://www.openwall.com/msulogin/ These revisions will handle possible NULL returns from crypt(3) gracefully, and msulogin 1.0 will also handle possible failure of tcgetattr(3) well. While at it, I've unified the license for all three of these projects to be the heavily cut-down BSD license that we've been using lately. Alexander
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.