Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <Pine.GSO.4.64.1108311823180.26123@faron.mitre.org>
Date: Wed, 31 Aug 2011 18:35:45 -0400 (EDT)
From: "Steven M. Christey" <coley@...-smtp.mitre.org>
To: oss-security@...ts.openwall.com
Subject: Re: CVE request: heap overflow in tcptrack < 1.4.2


I'm wondering if this should have received a CVE.

https://bugs.gentoo.org/show_bug.cgi?id=377917 quotes upstream:

    "This fixes a heap overflow in the parsing of the command line...
     this may have security repercussions if
     tcptrack is configured as a handler for other applications that can
     pass user-supplied command line input to tcptrack."

The "attack" is through a command line argument.  While it's listed as a 
sniffer, the above text suggests that tcptrack might not be 
setuid/privileged, since the only given scenario is "as a handler for 
other applications."  Unless this is a typical/known scenario, this seems 
like just another unprivileged application, in which case the control over 
a command line argument would not directly cross privilege boundaries, 
thus falling into the realm of "bug" and not "vulnerability."

- Steve


On Tue, 9 Aug 2011, Josh Bressers wrote:

>
>
> ----- Original Message -----
>> A heap overflow in the parsing of tcptrack's command line was found.
>> The details are pretty sparse, but here are some references:
>>
>> http://www.rhythm.cx/~steve/devel/tcptrack/#news
>> https://bugs.gentoo.org/show_bug.cgi?id=377917
>> https://bugzilla.redhat.com/show_bug.cgi?id=729096
>>
>
> Please use CVE-2011-2903.
>
> Thanks.
>
> --
>    JB
>

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.