Re: Disputing CVE-2011-4122

[Jeff Mitchell <mitchell () kde org>]

On 12/8/2011 4:53 PM, Kurt Seifried wrote:
>  
> > The documentation you linked to above is for LinuxPAM, not OpenPAM.
> > They're different systems and the bug only affects OpenPAM.
> >
> > --Jeff
> Right, my thought/comment is more around the point that this isn't
> defined in general very well anywhere (that I can find, and I assume
> OpenPAM and Linux PAM are going to implement things in a roughly similar
> manner) and that it probably should be defined better. In the meantime
> though it is likely that restrictions/filtering can be implemented but
> it needs to be done carefully since there is the potential for weirdness.

Sorry, misunderstood what you were getting at  :-)

Yes, agreed. It should be defined better, and as you pointed out apps
trying to filter or restrict things can be prone to mistakes. Which I
think exactly points out why this CVE is invalid; the lack of real
specification means that an application cannot successfully guess what
is valid, nor is it specified that an application should even try to
make such guesses. Given the current situation, OpenPAM is culpable
here, both for not checking the data it's receiving, and for having a
specification that makes it impossible for upstream apps to properly try
to help out.

--Jeff

Attachment: signature.asc
Description: OpenPGP digital signature