Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 19 Sep 2012 17:26:59 -0400
From: Michael Rash <>
To: Jan Lieskovsky <>
Cc: "Steven M. Christey" <>,,
	Damien Stuart <>
Subject: Re: CVE Request -- fwknop 2.0.3: Multiple security issues

On Sep 19, 2012, Jan Lieskovsky wrote:

> Hello Kurt, Steve, vendors,
>   multiple securit issues have been corrected in 2.0.3 upstream version of
> fwknop (
> ---------------------------------------------------------------------------
> 1) multiple DoS / code execution flaws:
>    Upstream patch:
>    [1];a=commitdiff;h=d46ba1c027a11e45821ba897a4928819bccc8f22
> 2) server did not properly validate allow IP addresses from malicious
>    authenticated clients
>    Upstream patch:
>    [2];a=commitdiff;h=f4c16bc47fc24a96b63105556b62d61c1ba7d799
> 3) strict filesystem permissions for various fwknop files are not verified
> 4) local buffer overflow in --last processing with a maliciously constructed ~/ file
>    Upstream patch:
>    [3];a=commitdiff;h=a60f05ad44e824f6230b22f8976399340cb535dc
> For the remaining ones:
> =======================
> 5) several conditions in which the server did not properly throw out maliciously constructed variables in the access.conf file
>    Upstream patch:
>    [4];a=commitdiff;h=e2c0ac4821773eb335e36ad6cd35830b8d97c75a
>    Note: This doesn't look like a security flaw (previously possible to provide malicious values
>    to access.conf file, but I assume it would required administrator privileges).
> 6) [test suite] Added a new fuzzing capability to ensure proper server-side input validation.
>    Note: Test-suite add-on, no CVE needed.
> 7) Fixed RPM builds by including the $(DESTDIR) prefix for uninstall-local and
>    install-exec-hook stages in
>    Upstream patch:
>    [5];a=commitdiff;h=c5b229c5c87657197b0c814ff22127d870b55753
>    Note: Also doesn't look like a fix for a security flaw.
> Could you allocate CVE ids for issues 1), 2), 3), and 4) ?
> [Cc-ed Damien and Michael from fwknop upstream to confirm
> they {the first four} should receive a CVE identifier].

I would say that the first four should receive CVE identifiers, yes.
For 5), it could be a security issue in older versions of fwknop if the
umask at install time was permissive enough to allow non-admin users to
modify the access.conf file, but this is unlikely I think so probably
doesn't deserve a CVE identifier.


Michael Rash
Key fingerprint: E2EF 0C8A 5AA9 654C 4763  B50F 37AC E946 7F51 8271

> Thank you && Regards, Jan.
> --
> Jan iankko Lieskovsky / Red Hat Security Response Team

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.