Re: Vulnerability in Software Suspend 2 (all versions)

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hi again.

On Mon, 2008-07-28 at 14:20 +0530, Jonathan Brossard wrote:
> Dear Nigel,
> 
> >This is not a bug in TuxOnIce (or for that matter other Linux
> >hibernation implementations, which would have the same issue).
> 
> Yes it is.
> 
> >TuxOnIce has no way to know what running applications have passwords
> >stored in memory or whether they are storing them in an encrypted format
> >or not. Bugs should be filed against applications that are storing
> >passwords in plain text.
> 
> We are talking about the password of tuxonice itself here...

TuxOnIce itself doesn't have any password support. Do you mean a
password for encrypted swap or such like?

> Please boot a computer using tuxonice, go for hibernation,
> reboot, and then type this (as root) :
> 
> xxd -l 32 -s 0x041e  /dev/mem
> 
> 
> >By the way, these contact email addresses are grossly out of date. For
> >TuxOnIce, the contact is nigel@xxxxxxxxxxxxx For swsusp and uswsusp
> >(which would have the same problem), refer to linux-pm@xxxxxxxxxxxxxxx
> 
> I did my best to find one on the site's website and ended up
> taking those of sourceforge.

Hmm, you're right there. I'll address that shortly.

Regards,

Nigel

_______________________________________________
linux-pm mailing list
linux-pm@xxxxxxxxxxxxxxxxxxxxxxxxxx
https://lists.linux-foundation.org/mailman/listinfo/linux-pm

[Index of Archives]     [Linux ACPI]     [Netdev]     [Ethernet Bridging]     [Linux Wireless]     [CPU Freq]     [Kernel Newbies]     [Fedora Kernel]     [Security]     [Linux for Hams]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux RAID]     [Linux Admin]     [Samba]

  Powered by Linux