bugtraq - Re: please retract CVE-2007-2056 "Time-of-Check-Time-of-Use File Race in AFFLIB"

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Sun, 29 Apr 2007 11:28:30 -0400
From: Tim <tmorgan@...curity.com>
To: Simson Garfinkel <simsong@....org>
Cc: Brian Carrier <brianc@...istech.com>, bugtraq@...urityfocus.com
Subject: Re: please retract CVE-2007-2056 "Time-of-Check-Time-of-Use File Race in AFFLIB"

Hello Simson,

> Please issue a statement retracting your "security vulnerability"  
> CV2-2007-2056.
> 
> Your alleged vulnerability in aimage is not a bug because the  
> function getlock() is never called.

You are correct.  I sincerely appologize for not catching this.  This
function is not called in versions 2.2.0 or 2.2.8.  This correction has
been made on our website along with some others.  For more information,
see:

http://www.vsecurity.com/bulletins/advisories/2007/afflib-toctou.txt
http://www.vsecurity.com/bulletins/advisories/2007/afflib-overflows.txt
http://www.vsecurity.com/bulletins/advisories/2007/afflib-shellinject.txt
http://www.vsecurity.com/bulletins/advisories/2007/afflib-fmtstr.txt

We are currently aware of no other exploitable flaws in AFFLIB.


thank you for validating our claims,
tim