[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Tue, 22 May 2012 12:11:19 -0600
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security@...ts.openwall.com
CC: maximilian attems <max@...o.at>, Dan Rosenberg <dan.j.rosenberg@...il.com>,
klibc@...or.com
Subject: Re: Re: [klibc] CVE request: klibc:
ipconfig sh script with unescaped DHCP options
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 05/22/2012 11:30 AM, Kurt Seifried wrote:
> On 05/22/2012 03:18 AM, maximilian attems wrote:
>> On Wed, 18 May 2011, Dan Rosenberg wrote:
>
>>> On Wed, May 18, 2011 at 4:29 PM, maximilian attems
>>> <max@...o.at> wrote:
>>>> On Wed, May 18, 2011 at 04:13:05PM -0400, Dan Rosenberg
>>>> wrote:
>>>>> Might it be worth fixing the insecure temporary file
>>>>> usage?
>>>>>
>>>>> 122 snprintf(fn, sizeof(fn), "/tmp/net-%s.conf",
>>>>> dev->name); 123 f = fopen(fn, "w");
>>>>>
>>>>> What if someone else has already created that file, or put
>>>>> a symlink or hard link there?
>>>>
>>>> for the initramfs case I don't see how. outside of initramfs
>>>> usage I'd agree that this needs fixing.
>>>>
>>>
>>> Right, this only applies after boot is done.
>
>> As klibc main target is initramfs usage this use case hasn't
>> come up much, so wasn't top priority. Just got reminded today by
>> checking ipconfig backlog patches.
>
>>>>> What if someone overwrites your string with command
>>>>> injection characters despite your stripping?
>>>>
>>>> please be more verbose, what example do you have in mind?
>>>>
>>>
>>> Sorry for not being clear. If you're concerned about scripts
>>> parsing this file while it has command injection strings in
>>> it, what's to stop someone from putting a malicious file there
>>> if one doesn't already exist? It sounds like the scripts that
>>> depend on this file should probably be fixed here, or the file
>>> itself should be moved to a location where it's not writable
>>> by unprivileged users.
>
>> ipconfig in latest klibc git uses /run as you suggested.
>> http://git.kernel.org/?p=libs/klibc/klibc.git;a=summary
>
>> thank you.
>
>
> Please use CVE-2012-2382 for this issue.
Please REJECT CVE-2012-2382, this is a duplicate of CVE-2011-1930, I
didn't check far back enough (my bad).
The original (correct assignment) is here:
http://seclists.org/oss-sec/2011/q2/460
Thanks to the security vendor that pointed this out (they did not want
public credit).
- --
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iQIcBAEBAgAGBQJPu9bHAAoJEBYNRVNeJnmTL8IQAIMEzlm10PF1VYv93J5QBeOI
DiDrhGc91MucGviPU4SXJiha+YvV9zuEJfxiuaStR15XhkzHN9k4c89aQgmTHaVH
lYbRMM8qCdhUyH9yz5br496riH8O7tVAdFE+cDoWo3JSmN+rRplN+Y4ibPduKY/B
vfaw+GowQWT5Ff0cm75iWNuiW+agnktJIZODeOwoO2NJl6hXewAPdkE2CjMTNB21
6WdLk47qXngVKum6KvhnBPG24IYJeNsi1P8rscATc01XqWgRXmeC94rLUWkXWbsX
i8OgynKJtNQqP6luEa1mi5PauHviFsYHBYc4pRzvSIU4Gxl7N2cFO7Tf7mi45Qpm
kY1bcAG7aVWCqLiqwI40JOZ9Z4FY3p/dboXaI8GmVbK06eMjjeBDlUx0C5xFZ9qJ
Sn8tWbGkHaHfLMxInrc8yeYUVQ4u+NMs7NFyzCBDhNP7uN+8HhJqMTvCsEOlSIxP
jIXbjI8NZ++eaLNGQyn0RtOa2+Z17XVKE+CoS+H4pfxGX66U/lHtRfxktkG5o9gH
Cs5LIJMfbF3AOJ5uER9I5sqPw4qOCPQr5ip5jyamCTveYl4EcXAJsAdGOwIhuQB8
4sfr49Bu2yItyj9+SBShk5JUVscYsZiPXPhP8WrtUnI9J72dvuwgFkZM8vyh1PPv
bV1/9OFluB7Pkmz98j06
=Yn84
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
