Full Disclosure mailing list archives
Re: [FLSA-2005:152794] Updated rp-pppoe package fixes security issue
From: "David F. Skoll" <devnull () roaringpenguin com>
Date: Tue, 15 Nov 2005 13:49:44 -0500
Marc Deslauriers wrote:
Synopsis: Updated rp-pppoe package fixes security issue Advisory ID: FLSA:152794
This is a totally bogus vulnerability, as I wrote in my response on http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0564 In fact, this so-called "fix" might tempt people to run rp-pppoe SUID-root, which is a Bad Thing, because there are probably tons of other reasons why a SUID-root rp-pppoe is dangerous. rp-pppoe 3.6 was released a while ago. It has a proper fix for SUID-ness. I recommend people use that instead of distro versions with dubious "security patches" NOTE: I have set the return path to <devnull () roaringpenguin com> to avoid hundreds of responses from Bugtraq readers' broken auto-responders. To reply to me, reply to <dfs () roaringpenguin com> Regards, David. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- [FLSA-2005:152794] Updated rp-pppoe package fixes security issue Marc Deslauriers (Nov 14)
- Re: [FLSA-2005:152794] Updated rp-pppoe package fixes security issue David F. Skoll (Nov 15)