Re: connman heads up / CVE requests

[Jan Lieskovsky <jlieskov () redhat com>]

Hi Sebastian,

On 05/07/2012 10:27 AM, Sebastian Krahmer wrote:
> Hi,
>
> I reported several issues

Just to confirm, you have meant four issues:
1) Conman doesn't check for the origin of netlink messages
   (from https://bugzilla.novell.com/show_bug.cgi?id=715172#c4)

   with patches:
   [1a] 
http://git.kernel.org/?p=network/connman/connman.git;a=commit;h=c1b968984212b46bea1330f5ae029507b9bfded9
   [1b] 
http://git.kernel.org/?p=network/connman/connman.git;a=commit;h=b0ec6eb4466acc57a9ea8be52c17b674b6ea0618

2) Check hostname validity prior setting the hostname in loopback
   plug-in:
   (from https://bugzilla.novell.com/show_bug.cgi?id=715172#c4)

   with patches:
   [2a] 
http://git.kernel.org/?p=network/connman/connman.git;a=commit;h=26ace5c59f790bce0f1988b88874c6f2c480fd5a
   [2b] 
http://git.kernel.org/?p=network/connman/connman.git;a=commit;h=a5f540db7354b76bcabd0a05d8eb8ba2bff4e911

3) DHCPv6 option parsing vulnerable to DoS (endless loop):
   (from https://bugzilla.novell.com/show_bug.cgi?id=715172#c9)

   with patches:
   There doesn't seem to be upstream patches for this yet.

4) Check vpnc options for validity prior saving them:
   (from https://bugzilla.novell.com/show_bug.cgi?id=715172#c10):

   with patches:
   [4a] 
http://git.kernel.org/?p=network/connman/connman.git;a=commit;h=651b5920aceb10a5c53424a9723d9365ba612316

> to the connman developers last week and it
> seems they made patches for most of them which were
> posted on their mailing list. The one that I am missing is related
> to the GKeyFile/VPN settings storage.

So yet another patch is needed to correct this except [4a]? Or is
[4a] unrelated to this?

> I did not review the
> patches itself, except checking them slightly.
> The bug report is here:
>
> https://bugzilla.novell.com/show_bug.cgi?id=715172
>
> It was not a full review, so some parts remain unchecked.
>
> Some dists seem to ship it and before it goes the wicd way,
> I'd rather ask for CVE's myself.

For now could you confirm count of the issues and links to
patches, where appropriate? (this will be needed anyway for
purpose of CVE request)

Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Response Team

> Sebastian