Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Sun, 8 Apr 2018 10:11:47 +0200
From: Hanno Böck <hanno@...eck.de>
To: oss-security@...ts.openwall.com
Subject: beep infoleak

Hi,

It's been found that beep - even after the fix for "holey beep" - can
be used to create an infoleak and to see which files exist with root
permissions:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=895115

Also there are Integer Overflows:
https://github.com/johnath/beep/issues/13

Also Sebastian Krahmer pointed out the fix is incomplete:
http://seclists.org/oss-sec/2018/q2/17

All of that without an existing upstream.

I question whether beep should be saved. It would require someone
carefully reviewing the code and effectively become the new upstream.
And all that for a tool talking to the PC speaker, which doesn't exist
in most modern systems anyway. Instead distros should consider not
installing it as suid or just killing the package altogether.
I heard some distros (suse) replace beep with a simple "printf '\a'"
which seems also a safe solution. (although it obviously kills all
frequency/length/etc features of original "beep").

-- 
Hanno Böck
https://hboeck.de/

mail/jabber: hanno@...eck.de
GPG: FE73757FA60E4E21B937579FA5880072BBB51E42

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ