full-disclosure - Re: iDefense Security Advisory 10.02.07: Sun Microsystems Solaris FIFO FS Information Disclosure Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Thu, 04 Oct 2007 13:15:46 -0400
From: "Joey Mengele" <joey.mengele@...hmail.com>
To: <labs-no-reply@...fense.com>, <customerservice@...fense.com>,
	<3apa3a@...urity.nnov.ru>
Cc: full-disclosure@...ts.grok.org.uk, vulnwatch@...nwatch.org,
	bugtraq@...urityfocus.com
Subject: Re: iDefense Security Advisory 10.02.07: Sun
	Microsystems Solaris FIFO FS Information Disclosure Vulnerability

Dear Amateur Security Studier PAPAPAPAPAPAPA,

The context in which the term memory leak is used should clue you 
in here. When used in this content, 'leaked' clearly means the 
contents are exposed to userspace. It clearly does not mean memory 
is allocated and then not freed. By the way, your posts are always 
stupid.

J

On Thu, 04 Oct 2007 12:38:51 -0400 3APA3A <3APA3A@...URITY.NNOV.RU> 
wrote:
>Dear iDefense Labs,
>
>--Wednesday, October 3, 2007, 6:32:03 PM, you wrote to 
>vulnwatch@...nwatch.org:
>
>
>iL> The vulnerability exists in the kernel ioctl() handler for 
>FIFOs. The
>iL> I_PEEK ioctl is used to peek at a number of bytes contained in 
>the FIFO
>iL> without actually removing them from the queue. One of the 
>arguments to
>iL> this command, which represents the number of bytes to peek, is 
>a signed
>iL> integer value. Since this parameter is not properly validated, 
>a
>iL> negative value can cause large amounts of kernel memory to be 
>leaked.
>
>Can  you  please  clarify this issue? According to subject it 
>looks like
>information  leak  (information  disclosure)  issue,  while 
>according to
>description, it looks more like memory leak (Denial of Service) 
>issue.
>
>
>-- 
>~/ZARAZA http://securityvulns.com/
>
>
>_______________________________________________
>Full-Disclosure - We believe in it.
>Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/