[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 02 Oct 2012 13:20:20 -0600
From: Kurt Seifried <kseifried@...hat.com>
To: Raphael Geissert <geissert@...ian.org>
CC: oss-security@...ts.openwall.com
Subject: Re: CVE request - mcrypt buffer overflow flaw
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 10/02/2012 12:42 PM, Raphael Geissert wrote:
> Kurt,
>
> I think at least one more CVE id needs to be assigned:
>
> On Saturday 15 September 2012 19:22:06 Raphael Geissert wrote:
>> On Tuesday 11 September 2012 10:19:38 Eygene Ryabinkin wrote:
>> Another week, another couple of patches. One makes it use strncpy
>> and forces a NUL on the last byte of local_algorithm, local_mode,
>> and local_keymode. Their values are checked later on, so it seems
>> safe to pass unvalidated data. The size of the buffers is
>> hard-coded to avoid making many changes to the code.
>
> I think this needs a separate id, since fixes were released by
> Fedora and Debian referencing CVE-2012-4409 but only for the
> original report.
>
> Eygene's followup issues have been fixed in Debian without
> referencing a CVE id.
Can you post a link to source fixes/commits? Thanks.
>> Once those issues were fixed I noticed that salt_size is not
>> initialized if the salt flag is not set. The result is an
>> inconditional call to malloc, with an uninitialized int as
>> argument. This can lead to a non-attacker-controlled memory
>> consumption DoS in most cases. It makes me think nobody actually
>> ever used it without a salt.
>
> I've no strong opinion on whether this deserves an id.
>
> Cheers,
Hrmm there's a thought, has this DoS been confirmed? As we've probably
seen over the last year more than a few sites fail to salt their
stored passwords =(.
- --
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://www.enigmail.net/
iQIcBAEBAgAGBQJQaz50AAoJEBYNRVNeJnmTSK4P/26UQ0ORk9a3iUwsegwosivb
S/hvJQ+nH8oXHrT4TX6sjwg0QacNHGVDcgMRf2iQVTSrDseJsFVz1EC+hQHR0A53
o3svXEb/11l+tpOxvXRaV2Tr5eU0BSwB+nDLiZgWry+IYLp17pyqdicNsLfwST6n
RZhWdI/cMFk7Oxm6FyM0fSoXWS95ixSCJrnRh60+PrZeKKe6K+Hw78+nMO9dUcjI
GQHrMMiNGY0CDwDrokQeYT6Asf96nXBurNjt/gd18u9QXp6NZ7hWLsfF/f8ISFC9
0firEfZYbBcuV7KSacPyk+kqgT+VsSXZPbCqeC78o8avHBN/pa7zjXmnJjBOH5ps
FD88YNv5hdk6NjCrK5PbfRqi79ltM1JzI6mDxXb7jmJ6OFbvdCcMqKoSMNQkkYRA
FaR0f3BOU2I/1JsYKcCUITLRjUAcvw1LQX6v9MWtEb3iN/jfGRYdXEa0hV75tgpq
qljttSu3i5F/x80/TrOfvtQ+unuESUulkeXExdMfOULnf9SBgxY7aZpbT9TCfBlI
qBY4xBZTtxh2lYwLTiCof0lCtu779uqKeszVi6LiF9SXv/4cm8srvU4K74CDIcjv
KLCP4ba+a/VihVBf2EUP2myRN7ayPXYwII6CtqYu4smhJc00UQFMtbFNghXx+3Sg
vU//7x41AXD3ET5hrRfL
=fa7h
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
