oss-security - Re: information request on security bug fix in GNU Gatekeeper 3.1

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Sat, 25 Aug 2012 10:29:59 +0200
From: Jan Willamowius <jan@...lamowius.de>
To: oss-security@...ts.openwall.com, jan@...lamowius.de
Subject: Re: information request on security bug fix in GNU Gatekeeper 3.1

Hi Raphael,

I was planning to give people a few days to update before releasing
detailed information.

But you are right, the possibility to create an unlimited number of
connections each with its own thread handling it is the issue that
creates an easy possibility for a DOS attack.

Regards,
Jan

-- 
Jan Willamowius, Founder of the GNU Gatekeeper Project
EMail  : jan@...lamowius.de
Website: http://www.gnugk.org
Support: http://www.willamowius.com/gnugk-support.html


Raphael Geissert wrote:
> Hi Jan,
> 
> On the announcement of release 3.1 of GNU Gatekeeper[1] there's a mention of 
> a security bug fix.
> Could you please shed some light on the security issue? is it related to the 
> status port connection limit feature that was recently added in [2] and 
> similar?
> 
> Thanks in advance.
> 
> Found via secunia SA50343 [3]
> 
> [1]http://www.gnugk.org/gnugk-3.1.html
> [2]http://openh323gk.cvs.sourceforge.net/viewvc/openh323gk/openh323gk/GkStatus.cxx?r1=1.132&r2=1.133
> [3]http://secunia.com/advisories/50343/
> 
> Kind regards,
> -- 
> Raphael Geissert - Debian Developer
> www.debian.org - get.debian.net
>

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.