Date: Thu, 19 Jun 2008 16:58:43 +0200 From: Jan Lieskovsky <jlieskov@...hat.com> To: oss-security@...ts.openwall.com Subject: Re: query on a pppol2tp_recvmsg() fix - security relevant? Hello guys, the fix as mentioned at: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=6b6707a50c7598a83820077393f8823ab791abf8;hp=2e761e0532a784816e7e822dbaaece8c5d4be14d is reasonable. Have investigated this issue in a little deep detail. Seems it could be a problem in case when the targeted host would run / have created the L2TP tunnel, would support the Point to Point protocol with the L2TP plugin enabled and then local, unprivileged user could potentially issue an PPP command / request with too long L2TP packet to force kernel heap corruption (DoS). But as there is no testcase / exploit available till now I am aware of, this all is only a presumption. If this would be a real problem, than hopefully only with low severity (due the special conditions / requirements that need to be satisfied to trigger this issue). Kind regards Jan iankko Lieskovsky RH kernel Security Response Team On Wed, 2008-06-18 at 19:41 +0300, Eren Türkay wrote: > On 18 Jun 2008 Wed 19:18:40 Marcus Meissner wrote: > > A customer asks us if the following is a security problem: > > Secunia issued an advisory for that issue. It seems that it's a security > problem, but I'm not sure :) > > http://secunia.com/advisories/30719/
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.