Bug#812795: fakeroot opens a tcp socket which is open to the internet

2016-01-26 Thread Alan Jenkins
On 26/01/2016, Clint Adams wrote: > On Tue, Jan 26, 2016 at 04:43:58PM +, Alan Jenkins wrote: >> Fix: replace htonl(INADDR_ANY) in fakerootd.c with htonl(INADDR_LOOPBACK). >> Not tested, but libfakeroot already connects to INADDR_LOOPBACK. I'm not >> aware of anything else this would break.

Bug#812795: fakeroot opens a tcp socket which is open to the internet

2016-01-26 Thread Clint Adams
On Tue, Jan 26, 2016 at 04:43:58PM +, Alan Jenkins wrote: > Fix: replace htonl(INADDR_ANY) in fakerootd.c with htonl(INADDR_LOOPBACK). > Not tested, but libfakeroot already connects to INADDR_LOOPBACK. I'm not > aware of anything else this would break. I believe there were people connectin

Bug#812795: fakeroot opens a tcp socket which is open to the internet

2016-01-26 Thread Alan Jenkins
Package: fakeroot Version: 1.20.2-1 Severity: normal Dear Maintainer, I noticed fakeroot-tcp binds a tcp socket to INADDR_ANY. This seems worrying, even if we don't know about specific vulnerabilities. I haven't disclosed this observation elsewhere. Triage: I'm not sure how predictable the