oss-security - Re: CVE Request (gpicview)

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / news community lists wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [<thread-prev] [thread-next>] [month] [year] [list]

Date: Tue, 26 Aug 2008 10:19:17 -0400 (EDT)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: oss-security@...ts.openwall.com
cc: coley@...re.org
Subject: Re: CVE Request (gpicview)

Jan,

Are there common usage scenarios under which gpicview would receive the
filename to create from some external source, say, as a web browser
plugin?

I'm asking because the missing "ask_before_save" issues only seem like
non-security bugs - the user messing him/herself up - unless the target
file can be influenced by an external attacker.

> http://sourceforge.net/tracker/index.php?func=detail&aid=2019481&group_id=180858&atid=894869
>
> Possible symlink attack via the temporary created "/tmp/rot.jpg"
> file used for image rotation.

Use CVE-2008-3791

> 2,
>
> http://sourceforge.net/tracker/index.php?func=detail&aid=2019485&group_id=180858&atid=894869
>
> By presence of the LIBJPEG library we could without confirmation rewrite
> the by the symlink targeted JPEG filesystem file.
>
> 3,
>
> http://sourceforge.net/tracker/index.php?func=detail&aid=2019492&group_id=180858&atid=894869
>
> Consequences: Bad enough, just think about them in context of the two
> previously mentioned issues.

These two might need a second CVE depending on the influence over the file
that "ask_before_save" would ask about.

- Steve

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.