oss-security - Re: Security fixes in m4-1.4.11

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / news community lists wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [<thread-prev] [month] [year] [list]

Date: Fri, 11 Apr 2008 14:19:57 -0400
From: Josh Bressers <bressers@...hat.com>
To: oss-security@...ts.openwall.com,
        "Steven M. Christey" <coley@...us.mitre.org>
cc: coley@...re.org
Subject: Re: Security fixes in m4-1.4.11

> 
> On Sun, 6 Apr 2008, Patrick J. Volkerding wrote:
> 
> > Minor security fix: Quote output of mkstemp.
> 
> Use CVE-2008-1687
> 
> > Security fix: avoid arbitrary code execution with 'm4 -F'.
> 
> Use CVE-2008-1688
> 
> Note - these CVE's will not be live until Monday.
> 

So I took a look at these today, I don't think either is really a security
issue.

Both issues are certainly bugs, but given each situation, it would be just
as easy to get a victim to run something blatantly malicious that doesn't
need to leverage obscure flaws in the language.

Has anyone else had a look?

Thanks.

-- 
    JB

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.