Re: CVE Request -- mosh (and probably vte too): mosh server DoS (long loop) due improper parsing of terminal parameters in terminal dispatcher

[Stefan Cornelius <scorneli () redhat com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 05/22/2012 07:39 PM, Kurt Seifried wrote:
> > B) vte issue: ============= 
> > http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=673871#5
>
> > there is similar issue in vte too (Gnome bug private for now): 
> > https://bugzilla.gnome.org/show_bug.cgi?id=676090
>
> > Cc-ed Behdad Esfahbod on this post to clarify, what are the
> > upstream plans regarding this report in vte and if the CVE id has
> > been already assigned for it.
>
> Will wait for confirmation.

Hi,

I think http://www.openwall.com/lists/oss-security/2012/05/23/6 is a
reasonable confirmation. Additionally, upstream fixed this in 0.32.2:
http://ftp.gnome.org/pub/GNOME/sources/vte/0.32/vte-0.32.2.news

In case you agree that all requirements are fulfilled, could you please
assign a CVE to the B) part?

Thanks in advance and kind regards,

- -- 
Stefan Cornelius / Red Hat Security Response Team


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQEcBAEBAgAGBQJP23f1AAoJEETwiYCjVSmPUN0H/1NUI3DHZkJkm3wTR36/YBd1
huq4Hxbtidvj/rm1ojXNkBNU+oyYLHV1fID79jt9y5TuQZs6erkHQXjsw8LzoGbl
Oc71epwlnon5sE7SFOJ8AvEBRzHXldeBOHkTKd2J7YkSu+RK4oM+qUh6ZWxVA0Ac
vdlhYkdHZZIpodOIXV281qNkM9SGG1UmQ5uKQaUGmEfH2AuvqyIq4+RdZb3howSw
mlniH5k1uGUNKGCwXaeaz8Oza6qhXJz3pTvv/09ZQJqApHd7BSkOyyGIAgNLk5FQ
KO5u+WBpJRoTzgw5cqyVVGWTtP0GM/O/zlgYR2shuOHEXvGLcqMP/Hd+E/PblRY=
=qBFl
-----END PGP SIGNATURE-----