Products Openwall GNU/*/Linux   server OS Linux Kernel Runtime Guard John the Ripper   password cracker Free & Open Source for any platform in the cloud Pro for Linux Pro for macOS Wordlists   for password cracking passwdqc   policy enforcement Free & Open Source for Unix Pro for Windows (Active Directory) yescrypt   KDF & password hashing yespower   Proof-of-Work (PoW) crypt_blowfish   password hashing phpass   ditto in PHP tcb   better password shadowing Pluggable Authentication Modules scanlogd   port scan detector popa3d   tiny POP3 daemon blists   web interface to mailing lists msulogin   single user mode login php_mt_seed   mt_rand() cracker Services Publications Articles Presentations Resources Mailing lists Community wiki Source code repositories (GitHub) Source code repositories (CVSweb) File archive & mirrors How to verify digital signatures OVE IDs What's new

Message-ID: <20131021164246.GA10431@openwall.com>
Date: Mon, 21 Oct 2013 20:42:46 +0400
From: Solar Designer <solar@...nwall.com>
To: announce@...ts.openwall.com
Subject: [openwall-announce] scanlogd 2.2.7, popa3d 1.0.3, msulogin 1.0

Hi,

I've just released minor updates of scanlogd, popa3d, and msulogin.
Most of the corresponding changes have been in Owl for a long while, but
I did not get around to making the proper releases until today.

scanlogd 2.2.7 is available from the usual location:

http://www.openwall.com/scanlogd/

In this version, I fixed an off-by-one bug in the safety check against
SCAN_MAX_COUNT.  In properly configured builds of scanlogd,
SCAN_WEIGHT_THRESHOLD is such that it's always hit before SCAN_MAX_COUNT
would be hit, so this bug did not matter for those.  However, other
projects reusing this code could make these settings runtime
(mis)configurable, thereby exposing the bug.  Luckily, in scanlogd
itself, if it is misconfigured like this, a port number written right
beyond the array limit would overwrite relatively unimportant data only
(part of the same struct), which could be directly provided/spoofed by
the remote system anyway.  However, in other projects reusing code from
scanlogd this could be different.  Thus, this change is unimportant for
scanlogd itself, but it may be a critical security fix for other
projects reusing this code.  I'd like to thank Florian Westphal for
reporting this bug.

popa3d 1.0.3 and msulogin 1.0 are also where you'd expect them:

http://www.openwall.com/popa3d/
http://www.openwall.com/msulogin/

These revisions will handle possible NULL returns from crypt(3)
gracefully, and msulogin 1.0 will also handle possible failure of
tcgetattr(3) well.

While at it, I've unified the license for all three of these projects to
be the heavily cut-down BSD license that we've been using lately.

Alexander

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.