Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 26 Aug 2008 10:19:17 -0400 (EDT)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: oss-security@...ts.openwall.com
cc: coley@...re.org
Subject: Re: CVE Request (gpicview)


Jan,

Are there common usage scenarios under which gpicview would receive the
filename to create from some external source, say, as a web browser
plugin?

I'm asking because the missing "ask_before_save" issues only seem like
non-security bugs - the user messing him/herself up - unless the target
file can be influenced by an external attacker.

> http://sourceforge.net/tracker/index.php?func=detail&aid=2019481&group_id=180858&atid=894869
>
> Possible symlink attack via the temporary created "/tmp/rot.jpg"
> file used for image rotation.

Use CVE-2008-3791

> 2,
>
> http://sourceforge.net/tracker/index.php?func=detail&aid=2019485&group_id=180858&atid=894869
>
> By presence of the LIBJPEG library we could without confirmation rewrite
> the by the symlink targeted JPEG filesystem file.
>
> 3,
>
> http://sourceforge.net/tracker/index.php?func=detail&aid=2019492&group_id=180858&atid=894869
>
> Consequences: Bad enough, just think about them in context of the two
> previously mentioned issues.

These two might need a second CVE depending on the influence over the file
that "ask_before_save" would ask about.

- Steve

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.