[evlog-dev] [PATCH] Fixed security issue with evlogrmtd daemon

This is a multi-part message in MIME format.
--------------040901030900010403090203
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit

Attach is the patch that would fix the potential security issue of 
evlogrmtd daemon.

The evlogrmtd accepts connections from remote hosts to receive forwarded 
events. This fix stops malicious users from sending negative password 
len during authentication (so they could exploit the buffer).

Thanks, Hien.

--------------040901030900010403090203
Content-Type: text/plain;
 name="evlogrmtd-1.5.3.patch"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline;
 filename="evlogrmtd-1.5.3.patch"

--- /home/nguyhien/prj/evlog/user/cmd/evlogd/evlogrmtd.c	Tue Jun 10 15:34:42 2003
+++ evlog/user/cmd/evlogd/evlogrmtd.c	Thu Jul 17 12:02:18 2003
@@ -788,7 +788,7 @@
 		memcpy(&pwlen, ci->authdata, sizeof(int));
 		pwlen = ntohl(pwlen);
 		total = sizeof(int) + pwlen;
-		if (total >= MAX_RMT_AUTHDATA - 1)
+		if (total >= MAX_RMT_AUTHDATA - 1 || total < ci->authdata_len)
 			goto failed;
 		n = total - ci->authdata_len;
 	}

--------------040901030900010403090203--



-------------------------------------------------------
This SF.net email is sponsored by: VM Ware
With VMware you can run multiple operating systems on a single machine.
WITHOUT REBOOTING! Mix Linux / Windows / Novell virtual machines at the
same time. Free trial click here: http://www.vmware.com/wl/offer/345/0