oss-sec mailing list archives
Re: radvd 1.8.2 released with security fixes
From: Solar Designer <solar () openwall com>
Date: Thu, 13 Oct 2011 22:51:22 +0400
On Thu, Oct 13, 2011 at 12:42:42PM +0530, Huzaifa Sidhpurwala wrote:
So from what i can see, the maximum harm which would occur if privsep_init() fails, is that radvd would effectively run in --singleprocess mode
I am an outside observer here (I haven't reviewed the code myself), but doesn't the above amount to admin-configured privilege separation not actually being enabled? If so, this sounds like a security issue to me. Alexander
Current thread:
- Re: radvd 1.8.2 released with security fixes, (continued)
- Re: radvd 1.8.2 released with security fixes Huzaifa Sidhpurwala (Oct 07)
- Re: radvd 1.8.2 released with security fixes Robert Święcki (Oct 07)
- Re: radvd 1.8.2 released with security fixes John Haxby (Oct 07)
- Re: radvd 1.8.2 released with security fixes Vasiliy Kulikov (Oct 08)
- Re: radvd 1.8.2 released with security fixes Reuben Hawkins (Oct 11)
- Re: radvd 1.8.2 released with security fixes Vasiliy Kulikov (Oct 12)
- Re: radvd 1.8.2 released with security fixes Vasiliy Kulikov (Oct 12)
- Ruby 3.0.10 WEBrick::HTTPRequest X-Forwarded-* Kurt Seifried (Oct 12)
- Re: radvd 1.8.2 released with security fixes Reuben Hawkins (Oct 14)
- Re: radvd 1.8.2 released with security fixes Robert Święcki (Oct 07)
- Re: radvd 1.8.2 released with security fixes Huzaifa Sidhpurwala (Oct 07)
- Re: radvd 1.8.2 released with security fixes Solar Designer (Oct 13)
- Re: radvd 1.8.2 released with security fixes Huzaifa Sidhpurwala (Oct 13)
- Re: radvd 1.8.2 released with security fixes Vasiliy Kulikov (Oct 14)
- Re: radvd 1.8.2 released with security fixes Yves-Alexis Perez (Oct 20)
- Re: radvd 1.8.2 released with security fixes Huzaifa Sidhpurwala (Oct 21)