Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 9 Nov 2009 20:49:33 -0500 (EST)
From: "Steven M. Christey" <>
To: Josh Bressers <>
        "Steven M. Christey" <>
Subject: Re: CVE request: oping allows the disclosure of 
 arbitrary file contents

On Mon, 9 Nov 2009, Josh Bressers wrote:

> That issue has a CVE id. I gave it CVE-2009-3614 quite some time ago.

A "feature" in our oss-security list monitor prevented me from noticing
this post.  Apologies.

> The discussion then branched out into if an unchecked call to setuid to
> drop permissions is a security flaw (as a user could cause it to fail,
> preventing oping from dropping privs). I saw nothing in the code that
> showed it to be anything but a bug, as oping doesn't do anything
> exciting after the call could fail.

OK, in this context I would agree (just to be consistent with my Oct 16

- Steve

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.