Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 16 Jan 2013 07:49:59 +0100
From: Salvatore Bonaccorso <carnil@...ian.org>
To: oss-security@...ts.openwall.com
Cc: Florian Weimer <fw@...eb.enyo.de>, team@...urity.debian.org
Subject: Re: CVE request: Digest::SHA double free when using
 load subroutine

Hi Kurt and Florian

On Tue, Jan 15, 2013 at 10:37:59PM -0700, Kurt Seifried wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> On 01/15/2013 12:37 PM, Florian Weimer wrote:
> > * Kurt Seifried:
> > 
> >> I'm not clear, how would an attacker exploit this? They'd need to
> >> be able to specify the file that gets hashed, and the file would
> >> have to be not present and would thus trigger the crash? Are
> >> there any real world examples of an affected application? (web
> >> based?)
> > 
> > My hunch is that this is just a bug, not a security issue.
> 
> I'll leave it for now, if anyone comes up with a security impact/etc.
> let us know! (I bet this never happens, ah well =).

Thanks for your feedback on this.

Regards,
Salvatore

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.