[41209] in bugtraq
Re: [FLSA-2005:152794] Updated rp-pppoe package fixes security issue
daemon@ATHENA.MIT.EDU (David F. Skoll)
Tue Nov 15 17:48:28 2005
Message-ID: <437A2DC8.9020401@roaringpenguin.com>
Date: Tue, 15 Nov 2005 13:49:44 -0500
From: "David F. Skoll" <devnull@roaringpenguin.com>
MIME-Version: 1.0
To: Marc Deslauriers <marcdeslauriers@videotron.ca>
Cc: bugtraq@securityfocus.com, full-disclosure@lists.grok.org.uk
In-Reply-To: <4379324B.7030909@videotron.ca>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Marc Deslauriers wrote:
> Synopsis: Updated rp-pppoe package fixes security issue
> Advisory ID: FLSA:152794
This is a totally bogus vulnerability, as I wrote in my response on
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0564
In fact, this so-called "fix" might tempt people to run rp-pppoe SUID-root,
which is a Bad Thing, because there are probably tons of other reasons
why a SUID-root rp-pppoe is dangerous.
rp-pppoe 3.6 was released a while ago. It has a proper fix for SUID-ness.
I recommend people use that instead of distro versions with
dubious "security patches"
NOTE: I have set the return path to <devnull@roaringpenguin.com> to avoid
hundreds of responses from Bugtraq readers' broken auto-responders. To
reply to me, reply to <dfs@roaringpenguin.com>
Regards,
David.
