Bug#505271: closed ... fixed in shadow 1:4.1.1-6
On Friday 23 January 2009 04:06, Paul Szabo wrote: Belatedly, I realize that this still leaves a DoS attack: fill up utmp with entries for all possible PIDs, then login will fail. Maybe that is properly Bug#505071 (as distinct from this one)? Please see there about ideas on how to perform this DoS without access to group utmp. Although from the description I think it's definately something that's good to fix, I do not think it's that serious to be a DSA. Still, thanks for your help in analysing these issues - I hope Nicolas will pick up on this for a future release of shadow. cheers, Thijs pgpYIwDfBRvDC.pgp Description: PGP signature
Bug#505271: closed ... fixed in shadow 1:4.1.1-6
Thanks for the DSA-1709 fix. Belatedly, I realize that this still leaves a DoS attack: fill up utmp with entries for all possible PIDs, then login will fail. Maybe that is properly Bug#505071 (as distinct from this one)? Please see there about ideas on how to perform this DoS without access to group utmp. Cheers, Paul Szabo p...@maths.usyd.edu.au http://www.maths.usyd.edu.au/u/psz/ School of Mathematics and Statistics University of SydneyAustralia -- To UNSUBSCRIBE, email to debian-bugs-rc-requ...@lists.debian.org with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Bug#505271: closed ... fixed in shadow 1:4.1.1-6
Hi Paul, On Thursday 27 November 2008 10:13, Paul Szabo wrote: How long do you expect it will take to in fact fix this bug (which is closed, pretend-fixed, still set to just serious severity)? Would it cause problems if I posted the exploit on Monday 1 Dec? Sorry for the delay incurred in fixing this in Debian stable. An update is now in preparation and will be released shortly. Thank you for reporting the issue to Debian. Thijs pgpKjmczWLz4T.pgp Description: PGP signature
Bug#505271: closed ... fixed in shadow 1:4.1.1-6
Dear Nicolas and Moritz, How long do you expect it will take to in fact fix this bug (which is closed, pretend-fixed, still set to just serious severity)? Would it cause problems if I posted the exploit on Monday 1 Dec? Thanks, Paul Paul Szabo [EMAIL PROTECTED] http://www.maths.usyd.edu.au/u/psz/ School of Mathematics and Statistics University of SydneyAustralia -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Bug#505271: closed ... fixed in shadow 1:4.1.1-6
Please fix for etch also. Please issue DSA. Please alert other Linux distros, they are also affected. Since you claim this issue is fixed, surely (?!) there is no harm in making the exploit public. Should (may) I do that now? Cheers, Paul Paul Szabo [EMAIL PROTECTED] http://www.maths.usyd.edu.au/u/psz/ School of Mathematics and Statistics University of SydneyAustralia -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
