Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 08 Dec 2011 17:59:47 -0500
From: Jeff Mitchell <>
CC: Kurt Seifried <>
Subject: Re: Disputing CVE-2011-4122

On 12/8/2011 4:53 PM, Kurt Seifried wrote:
>> The documentation you linked to above is for LinuxPAM, not OpenPAM.
>> They're different systems and the bug only affects OpenPAM.
>> --Jeff
> Right, my thought/comment is more around the point that this isn't
> defined in general very well anywhere (that I can find, and I assume
> OpenPAM and Linux PAM are going to implement things in a roughly similar
> manner) and that it probably should be defined better. In the meantime
> though it is likely that restrictions/filtering can be implemented but
> it needs to be done carefully since there is the potential for weirdness.

Sorry, misunderstood what you were getting at  :-)

Yes, agreed. It should be defined better, and as you pointed out apps
trying to filter or restrict things can be prone to mistakes. Which I
think exactly points out why this CVE is invalid; the lack of real
specification means that an application cannot successfully guess what
is valid, nor is it specified that an application should even try to
make such guesses. Given the current situation, OpenPAM is culpable
here, both for not checking the data it's receiving, and for having a
specification that makes it impossible for upstream apps to properly try
to help out.


Download attachment "signature.asc" of type "application/pgp-signature" (261 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.