Status of IEEE1394 vulnerability in 2.4

Status of IEEE1394 vulnerability in 2.4

[Moritz Muehlenhoff]

Hi,
what's the status of the IEEE 1394 vulnerability wrt
kernel 2.4? [1]
Will it be fixed in 2.4.27? rc3 is two weeks old and
there haven't been bitkeeper snapshots since April.

Cheers,
        Moritz

Footnotes:
[1] http://www.osvdb.org/displayvuln.php?osvdb_id=7253

Re: Status of IEEE1394 vulnerability in 2.4

[Ben Collins]

On Wed, Jul 21, 2004 at 02:32:57AM +0200, Moritz Muehlenhoff wrote:
> Hi,
> what's the status of the IEEE 1394 vulnerability wrt
> kernel 2.4? [1]
> Will it be fixed in 2.4.27? rc3 is two weeks old and
> there haven't been bitkeeper snapshots since April.

I have yet to fix them. Note that they are NOT as serious as described.
One requires a local user to have access to the devices. Generally this
isn't the default case. The other one requires maliciously changed
firmware in an external device. Not too many people have the know-how and
desire to do this, just to crash your system (they would have better luck
just beating your box with a hammer).

The other bug about allocating huge amounts of memory is just plain wrong,
and is not a bug. It cannot happen.

I'll be fixing things this weekend.

-- 
Debian     - http://www.debian.org/
Linux 1394 - http://www.linux1394.org/
Subversion - http://subversion.tigris.org/
WatchGuard - http://www.watchguard.com/