Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 10 Nov 2009 00:26:46 +0000 (UTC)
From: security curmudgeon <jericho@...rition.org>
To: oss-security@...ts.openwall.com
cc: "Steven M. Christey" <coley@...us.mitre.org>
Subject: Re: CVE request: oping allows the disclosure of 
 arbitrary file contents


On Mon, 9 Nov 2009, Steven M. Christey wrote:

: On Sat, 17 Oct 2009, yersinia wrote:
: 
: > On Fri, Oct 16, 2009 at 10:06 PM, Josh Bressers <bressers@...hat.com> wrote:
: > > ----- "Julien Tinnes" <julien.tinnes@...il.com> wrote:
: > >
: > > [snip]
: > >
: > > I took a look in the oping source. Without another security flaw, this is just
: > > a bug, oping doesn't do anything while still root that could be an issue. I
: > > agree that it should be fixed, it is a serious bug, but an attacker cannot do
: > > anything nefarious with this flaw.
: > I think that the upstream mantainer should be have the last word
: > http://verplant.org/liboping/
: 
: This says:
: 
:   2009-09-29 Version 1.3.3 is available. The new release fixes a serious
:   security issue in oping: If the application is installed with the
:   SetUID-bit, anybody on the system could use oping to read arbitrary
:   files using the "-f" option.
: 
: So as stated, this sounds worthy of a CVE to me.  Thoughts?

Is it so different than "vulnerable if dangerous_php_option=true is 
configured"? I guess the distinction is that we know many systems 
configure PHP with dangerous options, while admins generally don't run 
around slapping SUID on everything. 

To me, it is a vuln if there is a reasonable case where it may be SUID, 
or called with increased privileges.

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.