[Secure-testing-team] Bug#655044: glib2.0: ghashtable vulnerable to oCert-2011-003 DOS attacks

[John Lightsey]

Source: glib2.0
Severity: important
Tags: security

The standard hashing functions provided with the ghashtable implementation
in glib are vulnerable to the algorithmic complexity attacks described in
oCert-2011-003

http://www.ocert.org/advisories/ocert-2011-003.html

This was reported upstream in 2003 when Perl fixed their hashing
implementation by introducing a random hash seed. The upstream discussion
is archived here:

http://mail.gnome.org/archives/gtk-devel-list/2003-May/msg00111.html

-- System Information:
Debian Release: wheezy/sid
  APT prefers unstable
  APT policy: (500, 'unstable')
Architecture: amd64 (x86_64)

Kernel: Linux 3.1.0-1-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash