[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-Id: <201406180257.s5I2vgnq026214@linus.mitre.org>
Date: Tue, 17 Jun 2014 22:57:42 -0400 (EDT)
From: cve-assign@...re.org
To: yarrick@...o.se
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com, oscar@...araz.net
Subject: Re: CVE Request: iodine: authentication bypass by client
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
> iodine 0.7.0 has just been released, which fixes an authentication bypass
> issue
> https://github.com/yarrick/iodine/commit/b715be5cf3978fbe589b03b09c9398d0d791f850
> The client could bypass the password check by continuing after getting error
> from the server and guessing the network parameters. The server would still
> accept the rest of the setup and also network traffic.
>
> Add checks for normal and raw mode that user has authenticated before allowing
> any other communication.
Use CVE-2014-4168.
- --
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)
iQEcBAEBAgAGBQJToMEDAAoJEKllVAevmvmsNwgIAKFLSxMA6JXBvw5J+JiMJOVx
W61HnD6zhcfD2/5C4mQsfZx0hnqxVQHUcbPiydWVW6oRYn/GQRrpC7JkTkEP6wSt
bQdj+5krJAjiGG6ilQbHGEypdh5bZPs1rIaB0ZthnxGvEOmhJq2jO8vg+7DDoJf/
hm5rqx/BVToMCXqBjAniCJpRvnibTfBRd4n9r2wkYks4PB3wV43bI2k/UbkS3ya4
7FXWs1pFuVilJFlVRyEV4IzYb/32SU7Xl02G/8fNshczKZ0MrNqCh2OCqplUBqpN
wxjsgejqOY+PGu2md035LQWDMpxP4YlgwwtWFPyD+EsPJ8384C53TXcyQ9N1fZM=
=1/SN
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
