Re: Signedness bug in sctp_setsockopt() (security vulnerability).

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hi Sridhar,

> SCTP_SOCKOPT_DEBUG_NAME is an internal option that
> was supposed to be used
> only by the developers of SCTP, not users. Even the
> developers found that
> this isn't really needed and hence this option was
> removed in 2.4.26 and
> also from the 2.6 tree.

Thanks for the info Sridhar.  From your run-down
above, may I take it that the bug could be exploited,
if a host was running kernel 2.4.25 and below? 
Although it is now removed, I would be interested to
know.

> As Shaun pointed out, if this code was present it
> could have been a security
> issue, but as the code is no longer present, this is
> a non-issue.

I guess if this is exploitable, then the message is to
upgrade to 2.4.26 :)



Thank you for your time.
Shaun.


	
	
		
____________________________________________________________
Yahoo! Messenger - Communicate instantly..."Ping" 
your friends today! Download Messenger Now 
http://uk.messenger.yahoo.com/download/index.html
-
: send the line "unsubscribe linux-net" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[Index of Archives]     [Netdev]     [Ethernet Bridging]     [Linux 802.1Q VLAN]     [Linux Wireless]     [Kernel Newbies]     [Security]     [Linux for Hams]     [Netfilter]     [Git]     [Bugtraq]     [Yosemite News and Information]     [MIPS Linux]     [ARM Linux]     [Linux RAID]     [Linux PCI]     [Linux Admin]     [Samba]

  Powered by Linux