Date: Fri, 14 Nov 2008 12:35:41 -0500 (EST) From: "Steven M. Christey" <coley@...us.mitre.org> To: oss-security@...ts.openwall.com, jlieskov@...hat.com Subject: Re: CVE id request: htop Sorry Jan and Nico, I didn't follow up with you on this. There were some questions about whether this deserved a CVE, since THOUSANDS of programs dump output without considering whether they're writing to a terminal... or what they're writing to a terminal. For example, should the "cat" program become more terminal-aware and avoid sending dangerous sequences? Which of dozens of different terminal types should it avoid sending these sequences to? Should it get a new CVE every time it forgets about some other terminal? Not to mention "more" and "ls" and "grep" and many others. We were forced to flag Apache a number of years ago because it didn't filter certain dangerous characters from its logs. I always felt a bit funny about that one. Hopefully you see why this is an edge case for us. In this specific case, however, apparently top performs this behavior, it's clearly intended to run in a terminal, *and* a vendor is stating it's a security issue. So, CVE-2008-5076 has been assigned. - Steve ====================================================== Name: CVE-2008-5076 Status: Candidate URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5076 Reference: MLIST:[oss-security] 20081102 CVE id request: htop Reference: URL:http://www.openwall.com/lists/oss-security/2008/11/02/1 Reference: CONFIRM:http://bugs.debian.org/504144 Reference: XF:htop-processname-weak-security(46321) Reference: URL:http://xforce.iss.net/xforce/xfdb/46321 htop 0.7 writes process names to a terminal without sanitizing non-printable characters, which might allow local users to hide processes, modify arbitrary files, or have unspecified other impact via a process name with "crazy control strings."
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ