Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Fri, 26 Aug 2011 15:14:33 -0500
From: Jamie Strandboge <>
Subject: Security issue in hammerhead

A security bug was reported against hammerhead in Ubuntu. You are being
emailed as the upstream contact. Please keep[1] CC'd for any updates on this issue.

This issue should be considered public and has not yet been assigned a CVE.

Details from the public bug follow:

From the reporter:

"hammerhead blindly writes to to /tmp/hammer.log without prior checks.
It is possible to put a symbolic link at /tmp/hammer.log pointing at
another file - that hammerhead will then end up appending data into.
(it appears that hammerhead uses the file location as specified
in /etc/hammerhead/hh.conf - which in debian/ubuntu
is /tmp/hammer.log)."

A quick check shows that HH_LOG and REPORT_LOG are indeed being
unconditionally opened with 'fopen(..., "a+")' in src/ 

Thanks in advance for your cooperation in coordinating a fix for this

Jamie Strandboge

[1] is a public mailing list for
    people to collaborate on security vulnerabilities and coordinate
    security updates.

PS - I couldn't find a security contact for hammerhead, so emailed to
those I could find in AUTHORS.

Jamie Strandboge             |

Download attachment "signature.asc" of type "application/pgp-signature" (837 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.