[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20120507135922.GC31485@suse.de>
Date: Mon, 7 May 2012 15:59:22 +0200
From: Sebastian Krahmer <krahmer@...e.de>
To: oss-security@...ts.openwall.com
Subject: Re: connman heads up / CVE requests
Hi,
Thanks for disassembling my mail :)
> 1) Conman doesn't check for the origin of netlink messages
> (from https://bugzilla.novell.com/show_bug.cgi?id=715172#c4)
>
> with patches:
> [1a]
> http://git.kernel.org/?p=network/connman/connman.git;a=commit;h=c1b968984212b46bea1330f5ae029507b9bfded9
> [1b]
> http://git.kernel.org/?p=network/connman/connman.git;a=commit;h=b0ec6eb4466acc57a9ea8be52c17b674b6ea0618
Yes.
>
> 2) Check hostname validity prior setting the hostname in loopback
> plug-in:
> (from https://bugzilla.novell.com/show_bug.cgi?id=715172#c4)
>
> with patches:
> [2a]
> http://git.kernel.org/?p=network/connman/connman.git;a=commit;h=26ace5c59f790bce0f1988b88874c6f2c480fd5a
> [2b]
> http://git.kernel.org/?p=network/connman/connman.git;a=commit;h=a5f540db7354b76bcabd0a05d8eb8ba2bff4e911
Yes. The severity of this is quite high, its a default remote root exploit, as
connman is requesting hostname per dhcp by default and not checking for
shell escapes.
(I did not check whether they clean any other strings that could appear
and could contain newlines etc. when its written to a config file)
>
> 3) DHCPv6 option parsing vulnerable to DoS (endless loop):
> (from https://bugzilla.novell.com/show_bug.cgi?id=715172#c9)
>
> with patches:
> There doesn't seem to be upstream patches for this yet.
I think its this:
http://lists.connman.net/pipermail/connman/2012-May/009473.html
>
> 4) Check vpnc options for validity prior saving them:
> (from https://bugzilla.novell.com/show_bug.cgi?id=715172#c10):
AFAIK there is no patch for it yet. Upstream needs to verify/confirm these,
but I think its a real bug that lets you overwrite files.
Sebastian
--
~ perl self.pl
~ $_='print"\$_=\47$_\47;eval"';eval
~ krahmer@...e.de - SuSE Security Team
---
SUSE LINUX Products GmbH,
GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer, HRB 16746 (AG Nürnberg)
Maxfeldstraße 5
90409 Nürnberg
Germany
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
