Re: Disputing CVE-2011-4122

[Jeff Mitchell <mitchell () kde org>]

On 12/07/2011 11:26 AM, Kurt Seifried wrote:
> > One could assume that kcheckpass should do the validation. However, the
> > PAM documentation makes no mention of what a service name is supposed to
> > look like, and consequently it must be treated as opaque by the
> > application code. Therefore all validation must be expected to be done
> > by the library, and failure to do so must be seen as a bug in the
> > library exclusively.
>
> Can you provide a link to the documentation?

http://pubs.opengroup.org/onlinepubs/8329799/pam_start.htm

Thanks,
Jeff

Attachment: signature.asc
Description: OpenPGP digital signature