Date: Thu, 08 Dec 2011 17:59:47 -0500 From: Jeff Mitchell <mitchell@....org> To: oss-security@...ts.openwall.com CC: Kurt Seifried <kseifried@...hat.com> Subject: Re: Disputing CVE-2011-4122 On 12/8/2011 4:53 PM, Kurt Seifried wrote: > >> >> The documentation you linked to above is for LinuxPAM, not OpenPAM. >> They're different systems and the bug only affects OpenPAM. >> >> --Jeff >> > Right, my thought/comment is more around the point that this isn't > defined in general very well anywhere (that I can find, and I assume > OpenPAM and Linux PAM are going to implement things in a roughly similar > manner) and that it probably should be defined better. In the meantime > though it is likely that restrictions/filtering can be implemented but > it needs to be done carefully since there is the potential for weirdness. Sorry, misunderstood what you were getting at :-) Yes, agreed. It should be defined better, and as you pointed out apps trying to filter or restrict things can be prone to mistakes. Which I think exactly points out why this CVE is invalid; the lack of real specification means that an application cannot successfully guess what is valid, nor is it specified that an application should even try to make such guesses. Given the current situation, OpenPAM is culpable here, both for not checking the data it's receiving, and for having a specification that makes it impossible for upstream apps to properly try to help out. --Jeff Download attachment "signature.asc" of type "application/pgp-signature" (261 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.