Date: Fri, 01 Feb 2013 12:47:36 -0700 From: Kurt Seifried <kseifried@...hat.com> To: oss-security@...ts.openwall.com CC: "Fabio M. Di Nitto" <fdinitto@...hat.com>, Jan Lieskovsky <jlieskov@...hat.com>, "Steven M. Christey" <coley@...us.mitre.org>, Jan Friesse <jfriesse@...hat.com> Subject: Re: Re: CVE Request -- Corosync (2.0 <= X < 2.3): Remote DoS due improper HMAC initialization -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 02/01/2013 09:37 AM, Fabio M. Di Nitto wrote: > On 02/01/2013 05:26 PM, Jan Lieskovsky wrote: >> Hello Kurt, Steve, vendors, >> >> Corosync upstream has recently released 2.0.3 version correcting >> one security issue: > > No, this version is not correct. > > corosync >= 2.0 to < 2.3 are affected. > > corosync 2.3 and higher have the fix. > > Also, the DoS reason is not correct. The junk filter part is a > consequence on how libnss work and should be dropped. > > Subject should be: > > "CVE Request -- Corosync (2.0 <= X < 2.3): Remote DoS due improper > HMAC initialization" > >> >> A denial of service flaw was found in the way Corosync, the >> cluster engine and application programming interfaces, performed >> processing of certain network packets, when different encryption >> keys were used. Previously the HMAC key was not initialized >> properly, which allowed certain packets to pass through to the >> internal phases of the Corosync packet validation process, >> possibly leading to corosync daemon crash. > > I explained this in details and this description is not accurate. > > "A remote denial of service flaw was found in the way Corosync, > the cluster engine and application programming interfaces, > performed processing of network packets. Previously the HMAC key > was not initialized properly, which allowed random targeted packets > to be processed by the internal process of corosync and possibly > leading to a daemon crash". Please use CVE-2013-0250 for this issue. >> >> The HMAC initialization has been corrected in upstream via:  >> https://github.com/corosync/corosync/commit/b3f456a8ceefac6e9f2e9acc2ea0c159d412b595 >> >> >> but there might be more changes needed (Cc-in Fabio and Jan). > > 2 missing: > > https://github.com/corosync/corosync/commit/55dc09ea237482f827333759fd45608bc9518d64 > > https://github.com/corosync/corosync/commit/ebb007a16c6a8d9e6f783ed82b324cb232c64be5 Thanks for the additional info. > Thanks Fabio > - -- Kurt Seifried Red Hat Security Response Team (SRT) PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.13 (GNU/Linux) iQIcBAEBAgAGBQJRDBvYAAoJEBYNRVNeJnmTtpEP/j4utU/gLEpFy5geRV07sgG5 WpLX+i36ewQ4iUbDYNg7cZlaxn51zrC62G9bAz6Rdg8I55qH33d+xMVFi6UtFypB O/OBq7JMhRZzPW28oHnr5n9IBwNHp2AEkdgm8gdOncSyB8GYWpp+b4SZ0LcbuP7f Si5/BFzPqH0b22VgNKvs6iLC/aNArZPaXZXzrMGsBGYEGQJ9ydVzpQLvoHgMq4B4 pvLXsGwP3Eg27g+8901MxfP2E+hMP8K70CpIMpGEHAF/aKaupPrJ5OhTcc+ct9bs Sj8DxFImOT1EOWCEH2Gyu0q/IwqX4/UPsdyq5O7oMxP0dn4VC6rh9INxkt2ZNfx3 qMTp7efIQt3c6CDMUDGuRvGaI29nxPeWOKC+0IphPGoTW+Q+6T98NmGR/aeorObd 8wLshQavIYdlJsxm8oi8F3uDehSwvZaswR3JGJwSLZCF28sNXzkoPHavjkGg6n6R fxd0sCuYbx0dhU7IROX/1OL7Y0UG3I+PWbmqT60GfqSbfksXU9LsSbKiEeactYhU m/ihUVMFiecYQUrRiFo/NxWWNfR/W/Xx8RWZAruogmCl71C7bso8Pl0TEUVItKT8 8wg7YrZ+D5v/96sKNU754bEBX/vsMwmnFi17mdDxzo8aVzfW2ZiXhcrhIB7NGD/n aIfO27EEAQDcbbEq06vJ =o2zL -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.