Bug#506179: Fwd: Bug#506179: no-ip: remote code execution vulnerability

2008-11-20 Thread Andres Mejia
I'll upload to unstable. Will someone be handling the upload to stable? -- Regards, Andres signature.asc Description: This is a digitally signed message part.

Bug#506179: no-ip: remote code execution vulnerability

2008-11-20 Thread Avi Rozen
Nico Golde wrote: > Looks good please upload. > Thanks, but I'm just the resident code monkey ;-) Otavio should upload. > BTW, you should use size_t instead of int for a length > field. > True. Pushed a fix. Cheers, Avi. -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject

Bug#506179: no-ip: remote code execution vulnerability

2008-11-20 Thread Nico Golde
Hi, * Avi Rozen <[EMAIL PROTECTED]> [2008-11-19 20:17]: [...] > [1]http://git.debian.org/?p=collab-maint/no-ip.git;a=commit;h=60ed93621ff36d9731ba5d9f9336d6eb91122302 Looks good please upload. BTW, you should use size_t instead of int for a length field. In this case it doesn't matter as you cat

Bug#506179: no-ip: remote code execution vulnerability

2008-11-19 Thread Avi Rozen
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 I've pushed a fix[1] for this vulnerability, based on analysis of the exploit and the no-ip client code, and some limited local experiments. Note that I couldn't get a working reverse shell - I suspect the exploit itself is buggy, but I have no time t

Bug#506179: no-ip: remote code execution vulnerability

2008-11-18 Thread Raphael Geissert
Source: no-ip Severity: grave Version: 2.1.1-4 Tags: security Hi, An exploit[1] has been published for the no-ip DUC. At the moment there's no much other information than the one provided in the exploit, which I can summarise as: The exploit relies on DNS poisoning or man in the middle attacks