Hello.<br><br>Regarding this issue (#522123), the upstream (which I'm part of) never came out with a better patch, so I propose this one:<br><br><a href="http://svn.debian.org/wsvn/pkg-voip/destar/trunk/debian/patches/fixCVE-2008-6539.dpatch?rev=7821&sc=1">http://svn.debian.org/wsvn/pkg-voip/destar/trunk/debian/patches/fixCVE-2008-6539.dpatch?rev=7821&sc=1</a><br>
<br>I'm not sure of what to do with this package. Upstream development is stalled, but promises new releases soon. Meanwhile, the debian package is still out there.<br><br>I'd like some advice on this one, please.<br>
<br>Thank you<br><br>Alejandro.<br><br><div class="gmail_quote">2009/6/17 Steffen Joeris <span dir="ltr"><<a href="mailto:steffen.joeris@skolelinux.de">steffen.joeris@skolelinux.de</a>></span><br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
Hi Alejandro<br>
<br>
> > 3. I'm not sure of an optimal way to avoind junk injection, so I though<br>
> > of strings containing 'Cfg' which could lead to adding config objects as<br>
> > the exploit suggest.<br>
><br>
> I think the proper way would be to just make sure everything that is<br>
> written into the conffile ends with " and a , . If these signs are included<br>
> in the parameters, then they should probably be escaped and thus not<br>
> interpreted as ending the paramter or completely excluded. The problem is<br>
> that if they are escaped, the escaping sign is probably interpreted as a<br>
> part of the parameter, right? Otherwise, I'd suggest to blacklist these<br>
> signs and maybe give out an error.<br>
> How does that sound? Granted it is not the optimal solution, but I kind of<br>
> fail to come up with something more robust to be honest.<br>
Any word on that?<br>
<br>
cheers<br>
<font color="#888888">Steffen<br>
<br>
</font></blockquote></div><br><br clear="all"><br>-- <br>Alejandro Rios Peña<br>Avatar Ltda.<br><a href="http://www.avatar.com.co">http://www.avatar.com.co</a><br>Tel. (571) 742 7070<br>Calle 86 # 49c-42<br>Bogotá D.C.<br>