oss-security - Re: Security fixes in m4-1.4.11

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / news community lists wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [<thread-prev] [thread-next>] [month] [year] [list]

Date: Mon, 07 Apr 2008 21:37:37 +0200
From: Florian Weimer <fw@...eb.enyo.de>
To: oss-security@...ts.openwall.com
Cc: coley@...re.org
Subject: Re: Security fixes in m4-1.4.11

* Lubomir Kundrak:

> On Sun, 2008-04-06 at 20:42 -0400, Steven M. Christey wrote:
>> On Sun, 6 Apr 2008, Patrick J. Volkerding wrote:
>> 
>> > Minor security fix: Quote output of mkstemp.
>> 
>> Use CVE-2008-1687
>
> This does not sound like a security problem. Mkstemp would never output
> any shell metacharacters.

M4 performs macro expansion without any special characters present,
IIRC.  However, it's still unlikely that an mkstemp()-returned string
matches a macro, I think.

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.