oss-security - RFC: Denial of Service in XCache?

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <54082301.6030506@reactos.org>
Date: Thu, 04 Sep 2014 10:29:53 +0200
From: Pierre Schweitzer <pierre@...ctos.org>
To: OSS Security List <oss-security@...ts.openwall.com>
Subject: RFC: Denial of Service in XCache?

Dear all,

I'm looking for comments about a XCache bug which is visible in Ubuntu
12.04LTS (and left unfixed so far). It is #LP1189436
(https://bugs.launchpad.net/ubuntu/+source/xcache/+bug/1189436).
It basically happens when you try to query XCache state, then it SIGSEV
(and thus makes php5 crash). This can be easily reproduced with the
Munin plugin at: http://www.ohardt.net/dev/munin/ (munin_xcache.php
file). It triggers the crash on every query on our infrastructure.

I'm not sure it's a security issue as you may protect this using admin
password. But what about shared web hosting where you wouldn't have set
any password?

Was it spotted/reported on other distributions?

Cheers,

-- 
Pierre Schweitzer <pierre@...ctos.org>
System & Network Administrator
Senior Kernel Developer
ReactOS Deutschland e.V.

Download attachment "smime.p7s" of type "application/pkcs7-signature" (4305 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.