Re: information request on security bug fix in GNU Gatekeeper 3.1

[Jan Willamowius <jan () willamowius de>]

Hi Raphael,

I was planning to give people a few days to update before releasing
detailed information.

But you are right, the possibility to create an unlimited number of
connections each with its own thread handling it is the issue that
creates an easy possibility for a DOS attack.

Regards,
Jan

-- 
Jan Willamowius, Founder of the GNU Gatekeeper Project
EMail  : jan () willamowius de
Website: http://www.gnugk.org
Support: http://www.willamowius.com/gnugk-support.html


Raphael Geissert wrote:
> Hi Jan,
>
> On the announcement of release 3.1 of GNU Gatekeeper[1] there's a mention of 
> a security bug fix.
> Could you please shed some light on the security issue? is it related to the 
> status port connection limit feature that was recently added in [2] and 
> similar?
>
> Thanks in advance.
>
> Found via secunia SA50343 [3]
>
> [1]http://www.gnugk.org/gnugk-3.1.html
> [2]http://openh323gk.cvs.sourceforge.net/viewvc/openh323gk/openh323gk/GkStatus.cxx?r1=1.132&r2=1.133
> [3]http://secunia.com/advisories/50343/
>
> Kind regards,
> -- 
> Raphael Geissert - Debian Developer
> www.debian.org - get.debian.net