Bug 1110179 - iodine: authentication bypass fixed in version 0.7.0
Summary: iodine: authentication bypass fixed in version 0.7.0
Keywords:
Status: CLOSED DUPLICATE of bug 1110338
Alias: None
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1110181 1110182 CVE-2014-4168 1110339
Blocks:
TreeView+ depends on / blocked
 
Reported: 2014-06-17 07:55 UTC by Murray McAllister
Modified: 2019-09-29 13:18 UTC (History)
4 users (show)

Fixed In Version: iodine 0.7.0
Clone Of:
Environment:
Last Closed: 2014-06-18 04:57:05 UTC
Embargoed:

Attachments (Terms of Use)

Description Murray McAllister 2014-06-17 07:55:40 UTC 
iodine is used for tunneling IPv4 data through a DNS server. It was reported that the 0.7.0 release fixes an authentication bypass. Quoting the upstream commit message:

""
The client could bypass the password check by continuing after getting error
from the server and guessing the network parameters. The server would still
accept the rest of the setup and also network traffic.

Add checks for normal and raw mode that user has authenticated before allowing
any other communication.

Problem found by Oscar Reparaz.
""

Upstream commit:

https://github.com/yarrick/iodine/commit/b715be5cf3978fbe589b03b09c9398d0d791f850

CVE request:

http://seclists.org/oss-sec/2014/q2/543
Comment 1 Murray McAllister 2014-06-17 07:56:46 UTC 
Created iodine tracking bugs for this issue:

Affects: fedora-all [bug 1110181]
Affects: epel-all [bug 1110182]
Comment 2 Murray McAllister 2014-06-18 04:57:05 UTC 

*** This bug has been marked as a duplicate of bug 1110338 ***
Note You need to log in before you can comment on or make changes to this bug.