[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <1213887524.2316.36.camel@iankko.englab.brq.redhat.com>
Date: Thu, 19 Jun 2008 16:58:43 +0200
From: Jan Lieskovsky <jlieskov@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: query on a pppol2tp_recvmsg() fix - security
relevant?
Hello guys,
the fix as mentioned at:
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=6b6707a50c7598a83820077393f8823ab791abf8;hp=2e761e0532a784816e7e822dbaaece8c5d4be14d
is reasonable. Have investigated this issue in a little deep
detail. Seems it could be a problem in case when the targeted
host would run / have created the L2TP tunnel, would support
the Point to Point protocol with the L2TP plugin enabled
and then local, unprivileged user could potentially
issue an PPP command / request with too long L2TP packet
to force kernel heap corruption (DoS). But as there
is no testcase / exploit available till now I am aware
of, this all is only a presumption. If this would
be a real problem, than hopefully only with low severity
(due the special conditions / requirements that need
to be satisfied to trigger this issue).
Kind regards
Jan iankko Lieskovsky
RH kernel Security Response Team
On Wed, 2008-06-18 at 19:41 +0300, Eren Türkay wrote:
> On 18 Jun 2008 Wed 19:18:40 Marcus Meissner wrote:
> > A customer asks us if the following is a security problem:
>
> Secunia issued an advisory for that issue. It seems that it's a security
> problem, but I'm not sure :)
>
> http://secunia.com/advisories/30719/
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
