Bugtraq mailing list archives
Re: please retract CVE-2007-2056 "Time-of-Check-Time-of-Use File Race in AFFLIB"
From: Tim <tmorgan () vsecurity com>
Date: Sun, 29 Apr 2007 11:28:30 -0400
Hello Simson,
Please issue a statement retracting your "security vulnerability" CV2-2007-2056. Your alleged vulnerability in aimage is not a bug because the function getlock() is never called.
You are correct. I sincerely appologize for not catching this. This function is not called in versions 2.2.0 or 2.2.8. This correction has been made on our website along with some others. For more information, see: http://www.vsecurity.com/bulletins/advisories/2007/afflib-toctou.txt http://www.vsecurity.com/bulletins/advisories/2007/afflib-overflows.txt http://www.vsecurity.com/bulletins/advisories/2007/afflib-shellinject.txt http://www.vsecurity.com/bulletins/advisories/2007/afflib-fmtstr.txt We are currently aware of no other exploitable flaws in AFFLIB. thank you for validating our claims, tim
Current thread:
- please retract CVE-2007-2056 "Time-of-Check-Time-of-Use File Race in AFFLIB" Simson Garfinkel (Apr 30)
- Re: please retract CVE-2007-2056 "Time-of-Check-Time-of-Use File Race in AFFLIB" Tim (Apr 30)