lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
From: adeon at tlen.pl (Adam Dyga) Subject: openssh remote exploit There is also one little bug in the code, look below. | | void * | buffer_append_space(Buffer *buffer, u_int len) | { | void *p; | | if (len > 0x100000) | fatal("buffer_append_space: len %u not supported", len); | | /* If the buffer is empty, start using it from the beginning. | */ | if (buffer->offset == buffer->end) { | buffer->offset = 0; | buffer->end = 0; | } | restart: | /* If there is enough space to store all data, store it now. | */ | if (buffer->end + len < buffer->alloc) { [...] The comparision should be if (buffer->end + len <= buffer->alloc) { because buffer->end is not an offset of last byte in buffer, but it's an offset of first byte _afer_ the last byte in buffer. Anyway, this is not a security flaw. -- Greets adeon
Powered by blists - more mailing lists