Home page logo
/

oss-sec logo oss-sec mailing list archives

Re: CVE request: Digest::SHA double free when using load subroutine
From: Kurt Seifried <kseifried () redhat com>
Date: Tue, 15 Jan 2013 22:37:59 -0700

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 01/15/2013 12:37 PM, Florian Weimer wrote:
* Kurt Seifried:

I'm not clear, how would an attacker exploit this? They'd need to
be able to specify the file that gets hashed, and the file would
have to be not present and would thus trigger the crash? Are
there any real world examples of an affected application? (web
based?)

My hunch is that this is just a bug, not a security issue.

I'll leave it for now, if anyone comes up with a security impact/etc.
let us know! (I bet this never happens, ah well =).

- -- 
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iQIcBAEBAgAGBQJQ9jy3AAoJEBYNRVNeJnmT9pcP/j4OWfbjMveABoGn6vyvE1xs
ozwg0zhaYOMrZi2Um2Yq5+JZfTJfYFk6TB1oEpVemVWus5coKmRvoppVW8gkIyrs
k459a8XI6OyqQYxn7oE7FWnrFPguiI6Xdi8Vn6/olHgqBAUEPaVfGsmJhNtTtZy+
Aa4LhfnMTKlVjLIbkTvuCN0qQXHErrx+4xR25dktr/5b3giSshxZ27wRDNe8oQpz
6UqE2e118tq2g2BWEufLawqBBXrGkY5NIkJIBCeJVVF5tYl1O4RIY4vDz1BbVBMp
gdNlPDm2Lhe7OoHqr02PPwICReI6AGTnNCqV+xIcGSG3UznCPEz6ui+dWz8v4EiS
SqeFUaOub/DK3PHaIWkn4L3tHEI/AWrLVp9wnKYwWPalMwtlC4p1bdG/mUbV1ZFn
vbkrE13AHhwawr4TDBOSEW6BD5LnHRom0YV4FqS5lpfbgHeGhpXx6Kq0mPFEMJcU
tb6eVD83AKPv+TYxjJ+eGld629MJOyw0r+AX/JGw/aGIgYd3vrxBEoBFyvRYLQqk
famGZtecyau1ffZ9uWwcOQgu62Dd3UkyawTHU3sSX50OjukUQwOhbiB0qApq/+fQ
wICYdWSfmIx6j4upaGh/pW1zvQ4OgL6wAOyy0BSX43DZZMhfTJlBAv8EwM8I7VAg
3Qdpekqr6sugZUJzi8Kj
=4j+p
-----END PGP SIGNATURE-----


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]