[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <536A7BD1.5040506@redhat.com>
Date: Wed, 07 May 2014 12:30:41 -0600
From: Kurt Seifried <kseifried@...hat.com>
To: Open Source Security <oss-security@...ts.openwall.com>
Subject: A note on DBus and the Hash DOS
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
So many years ago some hash dos stuff happened. I checked into a
variety of programs using embedded copies of various things like
XML/etc. Also other programs that use hashing for stuff, one of which
is DBus.
The bad news: DBus has a vulnerable hash implementation
The good news: there doesn't appear to be many (any?) ways to inject
data easily to trigger this vulnerability.
So I don't think this needs a CVE since it isn't really trigger-able,
but posted this more as a reminder that hash DoS vulns are probably
still lurking in various places.
With thanks to Florian Weimer of the Red Hat Product Security Team who
did the actual code audit bits.
- --
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAEBAgAGBQJTanvQAAoJEBYNRVNeJnmTLz0P/2cxxh5dWawa5zBBDR0WFjrd
AK3QCgf+YRjbzyuUcL+mo7Vu1THbdR+EmyLih8SBmhm4hjwf6Q/ZZThKnFA6+9MO
3eYIxkJAHuHNG0RILOmxW7LVrWMW3VLoldaFlC1W2dBEgJMXacTUE31HL2PUFQ5R
44LYYtmGhSyHZOUjCasHmvxbqm37ktzXVxLUi2TVyKZVMYgJ8BPDxmaZTiqGI7/y
03908LSI6sasxLYMU8SFj7AY9CcvL/cCpednnoOevul3AdjNeUGo89rAiNCwys4K
svoh4updd+QFw6frxpGkY6W8BINIz+Pd2OeXyoeq9Dl+7SWsmyJmvij2ZUahjEQo
cGwJ6DvY1UvxUMj2hrRGwDuAaFvldgi7vLoOXSQa6Kp36ittCdj2aB4vpi71dxa6
pmpeSUvvLcSxLiDiYPMYgUUjF9M14qA3PcAzp9rU4e7CgqpqTxfEGqN41CSG/BpF
F3mVPhhzoHL4bH4EwLgW0a04kFxQnU8cvsLXxuHlQKjSrbISadqFKLk4HLNyy+cu
ixEvVYqqBRBwgCc+ZL+TvGmzefgngxaXsXXw1O8Z3h5WQer1+mMx9A3cEvS7MQ6n
gd92IjiJg5rE4SdCCdnmQsmD34GUWJN2OlUJ9+uGNy4lLgu23LWgFRZcgeMAVaEy
7LHGWbwB0IUvQmRC/S6z
=9i7N
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
