Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #171462 > unrolled thread

Any idea when CVE-2016-5696 is going to get fixed?

Started by"Perry E. Metzger" <perry@piermont.com>
First post2016-08-26 17:10 +0200
Last post2016-08-29 18:20 +0200
Articles 4 on this page of 24 — 13 participants

Back to article view | Back to linux.debian.user

Contents

  Any idea when CVE-2016-5696 is going to get fixed? "Perry E. Metzger" <perry@piermont.com> - 2016-08-26 17:10 +0200
    Re: Any idea when CVE-2016-5696 is going to get fixed? Mark Fletcher <mark27q1@gmail.com> - 2016-08-26 17:20 +0200
      Re: Any idea when CVE-2016-5696 is going to get fixed? Lisi Reisz <lisi.reisz@gmail.com> - 2016-08-26 18:40 +0200
        Re: Any idea when CVE-2016-5696 is going to get fixed? "Perry E. Metzger" <perry@piermont.com> - 2016-08-26 19:50 +0200
    Re: Any idea when CVE-2016-5696 is going to get fixed? Frederic Marchal <frederic.marchal@wowtechnology.com> - 2016-08-26 21:10 +0200
      Re: Any idea when CVE-2016-5696 is going to get fixed? "Perry E. Metzger" <perry@piermont.com> - 2016-08-27 05:20 +0200
        Re: Any idea when CVE-2016-5696 is going to get fixed? "John T. Haggerty" <jpcookie@gmail.com> - 2016-08-27 05:30 +0200
          Re: Any idea when CVE-2016-5696 is going to get fixed? Joe Pfeiffer <pfeiffer@cs.nmsu.edu> - 2016-08-27 17:50 +0200
        Re: Any idea when CVE-2016-5696 is going to get fixed? Frederic Marchal <frederic.marchal@wowtechnology.com> - 2016-08-28 14:40 +0200
          Re: Any idea when CVE-2016-5696 is going to get fixed? "Perry E. Metzger" <perry@piermont.com> - 2016-08-28 21:40 +0200
            Re: Any idea when CVE-2016-5696 is going to get fixed? deloptes <deloptes@gmail.com> - 2016-08-28 23:30 +0200
            Re: Any idea when CVE-2016-5696 is going to get fixed? Tixy <tixy@yxit.co.uk> - 2016-08-29 13:00 +0200
              Re: Any idea when CVE-2016-5696 is going to get fixed? "Perry E. Metzger" <perry@piermont.com> - 2016-08-29 18:20 +0200
                Re: Any idea when CVE-2016-5696 is going to get fixed? Gene Heskett <gheskett@shentel.net> - 2016-08-29 18:40 +0200
                  Re: Any idea when CVE-2016-5696 is going to get fixed? "Thomas Schmitt" <scdbackup@gmx.net> - 2016-08-29 19:40 +0200
                    Re: Any idea when CVE-2016-5696 is going to get fixed? "Perry E. Metzger" <perry@piermont.com> - 2016-08-29 20:30 +0200
                Re: Any idea when CVE-2016-5696 is going to get fixed? deloptes <deloptes@gmail.com> - 2016-08-29 23:50 +0200
                  Re: Any idea when CVE-2016-5696 is going to get fixed? Lisi Reisz <lisi.reisz@gmail.com> - 2016-08-30 00:40 +0200
                    Re: Any idea when CVE-2016-5696 is going to get fixed? Charlie <ariestao1@ipstarmail.com.au> - 2016-08-30 06:50 +0200
          Re: Any idea when CVE-2016-5696 is going to get fixed? "Neal P. Murphy" <neal.p.murphy@alum.wpi.edu> - 2016-08-29 03:30 +0200
            Re: Any idea when CVE-2016-5696 is going to get fixed? Mark Fletcher <mark27q1@gmail.com> - 2016-08-29 05:50 +0200
              Re: Any idea when CVE-2016-5696 is going to get fixed? "Neal P. Murphy" <neal.p.murphy@alum.wpi.edu> - 2016-08-29 07:10 +0200
                Re: Any idea when CVE-2016-5696 is going to get fixed? Salvatore Bonaccorso <carnil@debian.org> - 2016-08-29 07:30 +0200
                  Re: Any idea when CVE-2016-5696 is going to get fixed? "Perry E. Metzger" <perry@piermont.com> - 2016-08-29 18:20 +0200

Page 2 of 2 — ← Prev page 1 [2]

#171500

FromMark Fletcher <mark27q1@gmail.com>
Date2016-08-29 05:50 +0200
Message-ID<sblKa-26h-9@gated-at.bofh.it>
In reply to#171498

[Multipart message — attachments visible in raw view] — view raw

On Mon, 29 Aug 2016 at 10:21, Neal P. Murphy <neal.p.murphy@alum.wpi.edu>
wrote:

> On Sun, 28 Aug 2016 14:35:01 +0200
> Frederic Marchal <frederic.marchal@wowtechnology.com> wrote:
>
> > The attack is also useless if the attacker can't spoof the source IP
> > address. Routers in corporate environments usually block this by design
> or
> > due to VLAN. For that reason, the attack can't come from the same LAN to
> > bypass the border firewall. This rules out an unhappy coworker, infected
> > computer or a student with too much time on his hands.
>
> This is the first and foremost requirement. If the packets' source address
> cannot be spoofed, the attack cannot be attempted.
>
> I'm less concerned with how many sites/protocols are vulnerable than I am
> with how many ISPs allow spoofed packets out of their networks. It should
> be trivial for any ISP to drop packets that, given the source address,
> could not have originated within its network.
>
> In fact, I'd go so far as to say that no ISP should be allowed to connect
> to the internet unless solid anti-spoofing measures are in place.
>
> The CVE may be primarily of academic interest, but it is still a
> vulnerability that must be addressed. And the Debian crew will address it
> soon enough.
>
> Version 4.7 of the kernel contains a fix, which only required changes to
one source file, so I assume it's a question of back porting that fix into
the Jessie version of the kernel. I might take a look at trying that and
submit a patch if I can get it to work. (Now watch me trip over a dozen
issues I didn't think of when I try this)

Mark

[toc] | [prev] | [next] | [standalone]

#171501

From"Neal P. Murphy" <neal.p.murphy@alum.wpi.edu>
Date2016-08-29 07:10 +0200
Message-ID<sbmZz-36K-7@gated-at.bofh.it>
In reply to#171500
On Mon, 29 Aug 2016 03:43:15 +0000
Mark Fletcher <mark27q1@gmail.com> wrote:

> Version 4.7 of the kernel contains a fix, which only required changes to
> one source file, so I assume it's a question of back porting that fix into
> the Jessie version of the kernel. I might take a look at trying that and
> submit a patch if I can get it to work. (Now watch me trip over a dozen
> issues I didn't think of when I try this)

Greg K-H backported the fix(es) to 3.14.76. And a fix to the fix in 3.14.77. And Ben H. has the patch in 3.16.37, which is likely closer to what you need). The patches involve increasing the limit to 1000 ± some random factor, and per-socket rate limiting. It shouldn't be *too* difficult to backport that patch to Debian's kernel.

[toc] | [prev] | [next] | [standalone]

#171502

FromSalvatore Bonaccorso <carnil@debian.org>
Date2016-08-29 07:30 +0200
Message-ID<sbniW-3d6-17@gated-at.bofh.it>
In reply to#171501
Hi,

On Mon, Aug 29, 2016 at 01:08:45AM -0400, Neal P. Murphy wrote:
> On Mon, 29 Aug 2016 03:43:15 +0000
> Mark Fletcher <mark27q1@gmail.com> wrote:
> 
> > Version 4.7 of the kernel contains a fix, which only required changes to
> > one source file, so I assume it's a question of back porting that fix into
> > the Jessie version of the kernel. I might take a look at trying that and
> > submit a patch if I can get it to work. (Now watch me trip over a dozen
> > issues I didn't think of when I try this)
> 
> Greg K-H backported the fix(es) to 3.14.76. And a fix to the fix in
> 3.14.77. And Ben H. has the patch in 3.16.37, which is likely closer
> to what you need). The patches involve increasing the limit to 1000
> ± some random factor, and per-socket rate limiting. It shouldn't be
> *too* difficult to backport that patch to Debian's kernel.

The issue is already been worked on by Ben for all versions in sid,
jessie (and wheezy lts):

sid:
https://anonscm.debian.org/cgit/kernel/linux.git/commit/?h=sid&id=7184d7bfd94443b6403d71da639ec390224af594
(but then later just used as with 4.7.2 uploaded yesterday).

jessie:
https://anonscm.debian.org/cgit/kernel/linux.git/commit/?h=jessie-security&id=1bd5c3370523e5846019361b33a97c754db76f8d

wheezy:
https://anonscm.debian.org/cgit/kernel/linux.git/commit/?h=wheezy-security&id=f383788fb866fc61daf26836bccd92ebf7a6f02f

HTH,

Regards,
Salvatore

[toc] | [prev] | [next] | [standalone]

#171529

From"Perry E. Metzger" <perry@piermont.com>
Date2016-08-29 18:20 +0200
Message-ID<sbxrY-14K-29@gated-at.bofh.it>
In reply to#171502
On Mon, 29 Aug 2016 07:25:42 +0200 Salvatore Bonaccorso
<carnil@debian.org> wrote:
> The issue is already been worked on by Ben for all versions in sid,
> jessie (and wheezy lts):
> 
> sid:
> https://anonscm.debian.org/cgit/kernel/linux.git/commit/?h=sid&id=7184d7bfd94443b6403d71da639ec390224af594
> (but then later just used as with 4.7.2 uploaded yesterday).
> 
> jessie:
> https://anonscm.debian.org/cgit/kernel/linux.git/commit/?h=jessie-security&id=1bd5c3370523e5846019361b33a97c754db76f8d
> 
> wheezy:
> https://anonscm.debian.org/cgit/kernel/linux.git/commit/?h=wheezy-security&id=f383788fb866fc61daf26836bccd92ebf7a6f02f

Very cool. Any idea when the actual release by the security people
might be?

Perry
-- 
Perry E. Metzger		perry@piermont.com

[toc] | [prev] | [standalone]

Page 2 of 2 — ← Prev page 1 [2]

Back to top | Article view | linux.debian.user

csiph-web