oss-sec mailing list archives
Re: information request on security bug fix in GNU Gatekeeper 3.1
From: Jan Willamowius <jan () willamowius de>
Date: Sat, 25 Aug 2012 10:29:59 +0200
Hi Raphael, I was planning to give people a few days to update before releasing detailed information. But you are right, the possibility to create an unlimited number of connections each with its own thread handling it is the issue that creates an easy possibility for a DOS attack. Regards, Jan -- Jan Willamowius, Founder of the GNU Gatekeeper Project EMail : jan () willamowius de Website: http://www.gnugk.org Support: http://www.willamowius.com/gnugk-support.html Raphael Geissert wrote:
Hi Jan, On the announcement of release 3.1 of GNU Gatekeeper[1] there's a mention of a security bug fix. Could you please shed some light on the security issue? is it related to the status port connection limit feature that was recently added in [2] and similar? Thanks in advance. Found via secunia SA50343 [3] [1]http://www.gnugk.org/gnugk-3.1.html [2]http://openh323gk.cvs.sourceforge.net/viewvc/openh323gk/openh323gk/GkStatus.cxx?r1=1.132&r2=1.133 [3]http://secunia.com/advisories/50343/ Kind regards, -- Raphael Geissert - Debian Developer www.debian.org - get.debian.net
Current thread:
- information request on security bug fix in GNU Gatekeeper 3.1 Raphael Geissert (Aug 25)
- Re: information request on security bug fix in GNU Gatekeeper 3.1 Jan Willamowius (Aug 25)
- Re: Re: information request on security bug fix in GNU Gatekeeper 3.1 Kurt Seifried (Aug 26)
- Re: information request on security bug fix in GNU Gatekeeper 3.1 Raphael Geissert (Aug 27)
- Re: information request on security bug fix in GNU Gatekeeper 3.1 Jan Willamowius (Aug 25)