[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20161221200739.GA5225@hunt>
Date: Wed, 21 Dec 2016 12:07:39 -0800
From: Seth Arnold <seth.arnold@...onical.com>
To: tapper <lancett01@...glemail.com>
Cc: oss-security@...ts.openwall.com
Subject: Re: Curious about the security of my router fermwair.
On Wed, Dec 21, 2016 at 11:39:26AM +0000, tapper wrote:
> Hi my name is Jonathan. I don't know if this is the write place to ask
> about this but here gos.
It's not the usual use of this list but I suspect you won't upset many
people either.
> I would like to know if any one would like to have a poke around at the
> third party router firmware I use on my router called Gargoyle.
The first item I found in about one minute of inspection is that they
include an utterly ancient version of ffmpeg:
https://github.com/ericpaulbishop/gargoyle/blob/master/package/ffmpeg/Makefile#L10
PKG_NAME:=ffmpeg
PKG_VERSION:=2.4.4
PKG_RELEASE:=1
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
PKG_SOURCE_URL:=http://ffmpeg.org/releases/
PKG_MD5SUM:=7e2819c71484ffba1ba1a91dd5285643
The 2.4 branch of ffmpeg ended with version 2.4.13 on 2016-02-02. Not
only are they nine point releases behind, they are also drastically
behind on shipping newer versions entirely. (The latest version upstream
is numbered 3.2.2. That's seven minor versions behind, too.) Granted,
new versions bring new bugs, but picking one point in time two years
ago and then never updating is trouble.
I didn't spot any security fixes for ffmpeg in the patches-generic or
patches-old directories, but perhaps they just weren't clearly labeled.
Another concerning point is the use of md5 to validate the download. While
use of md5 as a 'better crc32' is well established, most cryptographic
authorities are saying it's time to replace md5's replacement, sha-1.
They're two hash functions behind the times.
A full review would take far more time than I have to offer but the
initial impression is that it needs a serious refresh of its dependencies.
Thanks
Download attachment "signature.asc" of type "application/pgp-signature" (474 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
