oss-sec mailing list archives
Re: connman heads up / CVE requests
From: Sebastian Krahmer <krahmer () suse de>
Date: Mon, 7 May 2012 15:59:22 +0200
Hi, Thanks for disassembling my mail :)
1) Conman doesn't check for the origin of netlink messages (from https://bugzilla.novell.com/show_bug.cgi?id=715172#c4) with patches: [1a] http://git.kernel.org/?p=network/connman/connman.git;a=commit;h=c1b968984212b46bea1330f5ae029507b9bfded9 [1b] http://git.kernel.org/?p=network/connman/connman.git;a=commit;h=b0ec6eb4466acc57a9ea8be52c17b674b6ea0618
Yes.
2) Check hostname validity prior setting the hostname in loopback plug-in: (from https://bugzilla.novell.com/show_bug.cgi?id=715172#c4) with patches: [2a] http://git.kernel.org/?p=network/connman/connman.git;a=commit;h=26ace5c59f790bce0f1988b88874c6f2c480fd5a [2b] http://git.kernel.org/?p=network/connman/connman.git;a=commit;h=a5f540db7354b76bcabd0a05d8eb8ba2bff4e911
Yes. The severity of this is quite high, its a default remote root exploit, as connman is requesting hostname per dhcp by default and not checking for shell escapes. (I did not check whether they clean any other strings that could appear and could contain newlines etc. when its written to a config file)
3) DHCPv6 option parsing vulnerable to DoS (endless loop): (from https://bugzilla.novell.com/show_bug.cgi?id=715172#c9) with patches: There doesn't seem to be upstream patches for this yet.
I think its this: http://lists.connman.net/pipermail/connman/2012-May/009473.html
4) Check vpnc options for validity prior saving them: (from https://bugzilla.novell.com/show_bug.cgi?id=715172#c10):
AFAIK there is no patch for it yet. Upstream needs to verify/confirm these, but I think its a real bug that lets you overwrite files. Sebastian -- ~ perl self.pl ~ $_='print"\$_=\47$_\47;eval"';eval ~ krahmer () suse de - SuSE Security Team --- SUSE LINUX Products GmbH, GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer, HRB 16746 (AG Nürnberg) Maxfeldstraße 5 90409 Nürnberg Germany
Current thread:
- connman heads up / CVE requests Sebastian Krahmer (May 07)
- Re: connman heads up / CVE requests Jan Lieskovsky (May 07)
- Re: connman heads up / CVE requests Sebastian Krahmer (May 07)
- Re: connman heads up / CVE requests Kurt Seifried (May 07)
- Re: connman heads up / CVE requests Sebastian Krahmer (May 08)
- Re: connman heads up / CVE requests Sebastian Krahmer (May 07)
- Re: connman heads up / CVE requests Jan Lieskovsky (May 07)