IPMItool / Patches(don't use) / #99 fix CVE-2011-4339

#99 fix CVE-2011-4339

Milestone: version-1.8.15

Status: closed-out-of-date

Owner: Zdenek Styblik

Labels: CVE (1)

Priority: 5

Updated: 2014-05-21

Created: 2014-05-20

Creator: Jörg Frings-Fürst

Private: No

fix CVE-2011-4339

1 Attachments

112_fix_CVE-2011-4339.patch

Discussion

Zdenek Styblik - 2014-05-20

CVE-2011-4339 has already been fixed. Please, drop this patch.

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Zdenek Styblik - 2014-05-20

status: open --> closed-out-of-date

assigned_to: Zdenek Styblik

Group: version-1.8.14 --> version-1.8.15
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Zdenek Styblik - 2014-05-20

http://ipmitool.cvs.sourceforge.net/viewvc/ipmitool/ipmitool/src/ipmievd.c?r1=1.35&r2=1.36

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Jörg Frings-Fürst - 2014-05-21

Please take a lock at https://bugzilla.redhat.com/attachment.cgi?id=525972

It's in lib/helper.c and not in src/ipmievd.c

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
- Zdenek Styblik - 2014-05-21
  
  I know it's in 'lib/helper.c', and?
  
  If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
- Zdenek Styblik - 2014-05-21
  
  CVE-2011-4339 was about ipmievd's PID file being world writable. And as far as I know, this has been fixed.
  
  If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Jörg Frings-Fürst - 2014-05-21

In the last downloadable tarball (1.8.14) is the bug not fixed.
And your link is from src/ipmievd.c.

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
- Zdenek Styblik - 2014-05-21
  
  Just because patch you've provided hasn't been applied doesn't mean it's not fixed, or does it?
  
  And yes, I believe 'src/ipmievd.c' that's where the fix should be. Feel free to prove me wrong.
  
  If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Log in to post a comment.