Re: please retract CVE-2007-2056 "Time-of-Check-Time-of-Use File Race in AFFLIB"

[Tim <tmorgan@xxxxxxxxxxxxx>]

Hello Simson,

> Please issue a statement retracting your "security vulnerability"  
> CV2-2007-2056.
> 
> Your alleged vulnerability in aimage is not a bug because the  
> function getlock() is never called.

You are correct.  I sincerely appologize for not catching this.  This
function is not called in versions 2.2.0 or 2.2.8.  This correction has
been made on our website along with some others.  For more information,
see:

http://www.vsecurity.com/bulletins/advisories/2007/afflib-toctou.txt
http://www.vsecurity.com/bulletins/advisories/2007/afflib-overflows.txt
http://www.vsecurity.com/bulletins/advisories/2007/afflib-shellinject.txt
http://www.vsecurity.com/bulletins/advisories/2007/afflib-fmtstr.txt

We are currently aware of no other exploitable flaws in AFFLIB.


thank you for validating our claims,
tim