[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20140507210912.7e5cb4f4@hboeck.de>
Date: Wed, 7 May 2014 21:09:12 +0200
From: Hanno Böck <hanno@...eck.de>
To: oss-security@...ts.openwall.com
Subject: Re: A note on DBus and the Hash DOS
On Wed, 07 May 2014 12:30:41 -0600
Kurt Seifried <kseifried@...hat.com> wrote:
> So many years ago some hash dos stuff happened. I checked into a
> variety of programs using embedded copies of various things like
> XML/etc. Also other programs that use hashing for stuff, one of which
> is DBus.
>
> The bad news: DBus has a vulnerable hash implementation
>
> The good news: there doesn't appear to be many (any?) ways to inject
> data easily to trigger this vulnerability.
I don't know how others feel about this, but I'd be more careful with
such cases.
Basically this sounds to me like a "we don't know if it is a
vulnerability, but it could be". And there I'd say "in doubt be on the
safe side".
Rate them as "very low impact", don't treat them with any urgency, but
I think such issues should be fixed and should be called
vulnerabilities nevertheless.
--
Hanno Böck
http://hboeck.de/
mail/jabber: hanno@...eck.de
GPG: BBB51E42
Download attachment "signature.asc" of type "application/pgp-signature" (837 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
