On Fri, Jan 06, 2017 at 01:53:47PM +0100, Sebastian Ramacher wrote: > It was fixed in 2-6-4+deb7u6.
Thanks, I can confirm that this fixes the problem. > Then perhaps the discussions you read are wrong or incomplete. Maybe there is > no > exploitable code out there using CTR mode, but it can be used to trigger the > very same buffer overflow as with ECB. Here is the interesting part of AES.new > before applying IVlen checks for ECB and CTR: You are correct, the discussion I was reading was apparently quite incomplete. Thank you for the thorough explanation, and my apologies for my error. Regards, Zed
