Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 12 Oct 2011 14:09:32 +0400
From: Vasiliy Kulikov <>
To: Reuben Hawkins <>
Subject: Re: radvd 1.8.2 released with security fixes

On Tue, Oct 11, 2011 at 23:26 -0700, Reuben Hawkins wrote:
> On Sat, Oct 8, 2011 at 9:55 AM, Vasiliy Kulikov <> wrote:
> > Crap, thank you for noticing it, guys.  The fix should be:
> >
> >
> >
> > Now, "", "..", "." and filenames with "/" inside are denied.

In case someone didn't fully track the discussion thread, I'll sum it up -

In the original patch the variable name is typoed/confused - the check
should be against "iface" instead of "name".  The check against "name"
is totally wrong as it checks a static hint string, which always passes
the check.

The confused blacklisted iface set is a bug, but not a security bug;
the confused variable name is indeed a security bug (not a flaw per se,
but it greatly weakens the privsep model).

Thanks to Solar Designer for pointing out that this thing is probably
not clear to everybody.

Vasiliy Kulikov - bringing security into open computing environments

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.