[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20111030161606.GA11526@albatros>
Date: Sun, 30 Oct 2011 20:16:06 +0400
From: Vasiliy Kulikov <segoon@...nwall.com>
To: Armin Burgmeier <armin@...ur.net>
Cc: oss-security@...ts.openwall.com, Armin Burgmeier <armin@...39.de>,
Philipp Kern <phil@...39.de>
Subject: Re: CVE request: 3 flaws in libobby and libnet6
Armin,
On Sun, Oct 30, 2011 at 17:20 +0100, Armin Burgmeier wrote:
> I have fixed the issues 1+3 in git [1,2]. It would be great if you could
> confirm the patches to really fix the issues you raised.
Looks like they do. FWIW, the counter overflow could be fixed by simply
using uint_64, which would overflow in 20 billion years :)
> As for the second issue, I do not think it is worth the effort to
> implement SSL certificate handling in obby. Both net6 and obby are
> replaced by libinfinity in the current development version of Gobby.
> libinfinity makes use of SSL certificates.
Some distros probably don't want to switch to the development version of
Gobby (which also uses a different dependency), but to fix the bugs of
their own stable versions.
As personally I am not a maintainer of a distro with the official Gobby
support, I don't care about maintaining old versions much, though. I'm
happy with the fixes in the dev version.
> We would be pleased if you could check for similar flaws in libinfinity
> though I admit that it is much more code and probably more complicated
> to analyze.
OK, I'll probably look at libinfinity at my spare time as I did it with obby.
Thanks,
--
Vasiliy Kulikov
http://www.openwall.com - bringing security into open computing environments
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
