oss-security - audit log injection attack via login

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <22959.1208823800@devserv.devel.redhat.com>
Date: Mon, 21 Apr 2008 20:23:20 -0400
From: Josh Bressers <bressers@...hat.com>
To: oss-security@...ts.openwall.com
Cc: Karel Zak <kzak@...hat.com>, Steve Grubb <sgrubb@...hat.com>,
        Miloslav Trmac <mitr@...hat.com>, coley@...re.org
Subject: audit log injection attack via login

Steve Grubb just let us know about an audit log injection flaw in login.
It's already public via a checkin:
http://git.kernel.org/?p=utils/util-linux-ng/util-linux-ng.git;a=commit;h=8ccf0b253ac0f4f58d64bc9674de18bff5a88782

I'm under the impression this should probably get a new CVE id (added Steve
Christey to the CC list for this).

Steve Grubb is also pretty sure there are other things that have this
problem, he's investigating.

Thanks.

-- 
    JB

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.