full-disclosure - Re: [FLSA-2005:152794] Updated rp-pppoe package fixes security issue

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <437A2DC8.9020401@roaringpenguin.com>
Date: Tue Nov 15 18:51:05 2005
From: devnull at roaringpenguin.com (David F. Skoll)
Subject: Re: [FLSA-2005:152794] Updated rp-pppoe package
	fixes security issue

Marc Deslauriers wrote:

> Synopsis:          Updated rp-pppoe package fixes security issue
> Advisory ID:       FLSA:152794

This is a totally bogus vulnerability, as I wrote in my response on
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0564

In fact, this so-called "fix" might tempt people to run rp-pppoe SUID-root,
which is a Bad Thing, because there are probably tons of other reasons
why a SUID-root rp-pppoe is dangerous.

rp-pppoe 3.6 was released a while ago.  It has a proper fix for SUID-ness.
I recommend people use that instead of distro versions with
dubious "security patches"

NOTE: I have set the return path to <devnull@...ringpenguin.com> to avoid
hundreds of responses from Bugtraq readers' broken auto-responders.  To
reply to me, reply to <dfs@...ringpenguin.com>

Regards,

David.