Date: Sun, 8 Apr 2018 10:11:47 +0200 From: Hanno Böck <hanno@...eck.de> To: oss-security@...ts.openwall.com Subject: beep infoleak Hi, It's been found that beep - even after the fix for "holey beep" - can be used to create an infoleak and to see which files exist with root permissions: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=895115 Also there are Integer Overflows: https://github.com/johnath/beep/issues/13 Also Sebastian Krahmer pointed out the fix is incomplete: http://seclists.org/oss-sec/2018/q2/17 All of that without an existing upstream. I question whether beep should be saved. It would require someone carefully reviewing the code and effectively become the new upstream. And all that for a tool talking to the PC speaker, which doesn't exist in most modern systems anyway. Instead distros should consider not installing it as suid or just killing the package altogether. I heard some distros (suse) replace beep with a simple "printf '\a'" which seems also a safe solution. (although it obviously kills all frequency/length/etc features of original "beep"). -- Hanno Böck https://hboeck.de/ mail/jabber: hanno@...eck.de GPG: FE73757FA60E4E21B937579FA5880072BBB51E42
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ