oss-security - Re: CVE Request -- mosh (and probably vte too): mosh server DoS (long loop) due improper parsing of terminal parameters in terminal dispatcher

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri, 15 Jun 2012 19:59:18 +0200
From: Stefan Cornelius <scorneli@...hat.com>
To: oss-security@...ts.openwall.com
CC: Kurt Seifried <kseifried@...hat.com>, Jan Lieskovsky <jlieskov@...hat.com>,
        "Steven M. Christey" <coley@...us.mitre.org>,
        Behdad Esfahbod <behdad@...dad.org>
Subject: Re: CVE Request -- mosh (and probably vte too): mosh
 server DoS (long loop) due improper parsing of terminal parameters in terminal
 dispatcher

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 05/22/2012 07:39 PM, Kurt Seifried wrote:
>> B) vte issue: ============= 
>> http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=673871#5
> 
>> there is similar issue in vte too (Gnome bug private for now): 
>> https://bugzilla.gnome.org/show_bug.cgi?id=676090
> 
>> Cc-ed Behdad Esfahbod on this post to clarify, what are the
>> upstream plans regarding this report in vte and if the CVE id has
>> been already assigned for it.
> 
> Will wait for confirmation.
> 

Hi,

I think http://www.openwall.com/lists/oss-security/2012/05/23/6 is a
reasonable confirmation. Additionally, upstream fixed this in 0.32.2:
http://ftp.gnome.org/pub/GNOME/sources/vte/0.32/vte-0.32.2.news

In case you agree that all requirements are fulfilled, could you please
assign a CVE to the B) part?

Thanks in advance and kind regards,

- -- 
Stefan Cornelius / Red Hat Security Response Team


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQEcBAEBAgAGBQJP23f1AAoJEETwiYCjVSmPUN0H/1NUI3DHZkJkm3wTR36/YBd1
huq4Hxbtidvj/rm1ojXNkBNU+oyYLHV1fID79jt9y5TuQZs6erkHQXjsw8LzoGbl
Oc71epwlnon5sE7SFOJ8AvEBRzHXldeBOHkTKd2J7YkSu+RK4oM+qUh6ZWxVA0Ac
vdlhYkdHZZIpodOIXV281qNkM9SGG1UmQ5uKQaUGmEfH2AuvqyIq4+RdZb3howSw
mlniH5k1uGUNKGCwXaeaz8Oza6qhXJz3pTvv/09ZQJqApHd7BSkOyyGIAgNLk5FQ
KO5u+WBpJRoTzgw5cqyVVGWTtP0GM/O/zlgYR2shuOHEXvGLcqMP/Hd+E/PblRY=
=qBFl
-----END PGP SIGNATURE-----

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.