From mboxrd@z Thu Jan 1 00:00:00 1970 X-Msuck: nntp://news.gmane.org/gmane.linux.lib.musl.general/7423 Path: news.gmane.org!not-for-mail From: Laurent Bercot Newsgroups: gmane.linux.lib.musl.general Subject: Re: Re: Security advisory for musl libc - stack-based buffer overflow in ipv6 literal parsing [CVE-2015-1817] Date: Sat, 18 Apr 2015 20:27:37 +0200 Message-ID: <5532A219.7010200@skarnet.org> References: <20150417131008.GE17615@ucc.gu.uwa.edu.au> <20150417172327.GB6817@brightrain.aerifal.cx> <20150417180325.GC6817@brightrain.aerifal.cx> <20150417180907.GA26856@openwall.com> <20150418133202.GG17615@ucc.gu.uwa.edu.au> <20150418152542.GG6817@brightrain.aerifal.cx> <55327D1F.5070807@gmx.de> <20150418155845.GH6817@brightrain.aerifal.cx> <55328604.4000705@gmx.de> <20150418163702.GI6817@brightrain.aerifal.cx> <55328F53.1070705@gmx.de> Reply-To: musl@lists.openwall.com NNTP-Posting-Host: plane.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit X-Trace: ger.gmane.org 1429381670 26302 80.91.229.3 (18 Apr 2015 18:27:50 GMT) X-Complaints-To: usenet@ger.gmane.org NNTP-Posting-Date: Sat, 18 Apr 2015 18:27:50 +0000 (UTC) To: musl@lists.openwall.com Original-X-From: musl-return-7436-gllmg-musl=m.gmane.org@lists.openwall.com Sat Apr 18 20:27:50 2015 Return-path: Envelope-to: gllmg-musl@m.gmane.org Original-Received: from mother.openwall.net ([195.42.179.200]) by plane.gmane.org with smtp (Exim 4.69) (envelope-from ) id 1YjXT3-0001gH-Hr for gllmg-musl@m.gmane.org; Sat, 18 Apr 2015 20:27:49 +0200 Original-Received: (qmail 13359 invoked by uid 550); 18 Apr 2015 18:27:47 -0000 Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: Original-Received: (qmail 13341 invoked from network); 18 Apr 2015 18:27:47 -0000 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:31.0) Gecko/20100101 Thunderbird/31.6.0 In-Reply-To: <55328F53.1070705@gmx.de> Xref: news.gmane.org gmane.linux.lib.musl.general:7423 Archived-At: On 18/04/2015 19:07, Harald Becker wrote: > AFAIK, you use a CNAME as MX, which is resolved on some, but not all > systems / programs. You need to add an absolute IP address for your > MX, not a CNAME, to be accessible for all. Indeed. The normative text is RFC 2181, section 10.3 : it explicitly forbids MX targets to be a CNAME. Most modern MTAs don't care, but some old ones *cough* sendmail *cough* do. > I didn't think of an exec to a separate program, but just fork and > let a process for key management run in the back. So a bit simpler to > verify authentication of caller, but still somehow required ... or > what else did you suggest? I second the fact that forking several communicating processes at start, each process dropping privileges to the minimal amount required to do its job, is the most secure design. (That's how qmail was designed, way back in 1996, and it's definitely the right approach for secure Unix programming.) If there's interest in converting dropbear to that model, I'd be happy to help. -- Laurent