[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <4EE14163.80109@kde.org>
Date: Thu, 08 Dec 2011 17:59:47 -0500
From: Jeff Mitchell <mitchell@....org>
To: oss-security@...ts.openwall.com
CC: Kurt Seifried <kseifried@...hat.com>
Subject: Re: Disputing CVE-2011-4122
On 12/8/2011 4:53 PM, Kurt Seifried wrote:
>
>>
>> The documentation you linked to above is for LinuxPAM, not OpenPAM.
>> They're different systems and the bug only affects OpenPAM.
>>
>> --Jeff
>>
> Right, my thought/comment is more around the point that this isn't
> defined in general very well anywhere (that I can find, and I assume
> OpenPAM and Linux PAM are going to implement things in a roughly similar
> manner) and that it probably should be defined better. In the meantime
> though it is likely that restrictions/filtering can be implemented but
> it needs to be done carefully since there is the potential for weirdness.
Sorry, misunderstood what you were getting at :-)
Yes, agreed. It should be defined better, and as you pointed out apps
trying to filter or restrict things can be prone to mistakes. Which I
think exactly points out why this CVE is invalid; the lack of real
specification means that an application cannot successfully guess what
is valid, nor is it specified that an application should even try to
make such guesses. Given the current situation, OpenPAM is culpable
here, both for not checking the data it's receiving, and for having a
specification that makes it impossible for upstream apps to properly try
to help out.
--Jeff
Download attachment "signature.asc" of type "application/pgp-signature" (261 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
