Security bugs are reported here via bugzilla

[bugzilla-daemon AT metalab.unc.edu]

http://bugs.sourcemage.org/show_bug.cgi?id=3362





------- Additional Comments From seth AT tautology.org  2003-05-16 19:30 -------
this one has a patch:

http://marc.theaimsgroup.com/?l=bk-commits-24&m=105217616607144&w=2

this one doesn't:

http://bugzilla.kernel.org/show_bug.cgi?id=703

let's patch the remote DoS at least.  I've got a patches/hashDoS file made up 
to
get the patch from within the bitkeeper url above ;)

testing the compile now.

Does require a very small change to PRE_BUILD to allow urls with & in them.

BTW, sorcery is borked for urls with & in them, so I did a nice hack job, 
where
I did \& to it.  Also note that the stupid download routine tries to FUZZ the
url to add a .tar.bz2 to the end of it, so I just faked it out with a dirty
hack...  but it's all working now.

hashDoS

#!/bin/bash

DESCRIPTION="security fix for hash table DoS"
SHORT="security fix for hash table DoS"
HELP="Vulnerability: CAN-2003-0244
Several hash table implementations in the networking were remotely 
exploitable.
 Remote attackers could launch attacks whereby, using carefully choosen forged
source addresses, make every routing cache entry get hashed into the same hash
chain.


Netfilter's IP conntrack module and the TCP syn-queue implementation had
identical vulnerabilities and have been fixed too.

The choosen solution to the problem involved using Bob's Jenkins hash along 
with
a randomly choosen input.  For the ipv4 routing cache we take things one step
further and periodically choose a new random secret.  By default this happens
every 10 minutes, but this is configurable by the user via sysctl knobs.

This patch is for 2.4.20
"
VERSIONS="2.4.20"

MD5S[0]=0a9d83f0fb0715c3cef97a66f86e9b69

if [[ "$1" == "CONFIG" ]]; then
echo "
SOURCE${COUNTER}='index.html?m=105217616607144\\&q=raw'
SOURCE${COUNTER}_URL='http://marc.theaimsgroup.com/?m=105217616607144\\&q=raw;FAKE=.tar.bz2'"
>> ${SPELL_CONFIG}.DETAILS
source $SCRIPT_DIRECTORY/MD5PATCH
fi

PRE_BUILD: change "$mFILE" to unquoted $mFILE in md5check()

I'm going to submit this once it's all tested.  Does anybody know where the
patch is for the local vuln?



------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.