[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 22 May 2012 11:18:49 +0200
From: maximilian attems <max@...o.at>
To: Dan Rosenberg <dan.j.rosenberg@...il.com>
Cc: oss-security@...ts.openwall.com, klibc@...or.com
Subject: Re: [klibc] CVE request: klibc: ipconfig sh script
with unescaped DHCP options
On Wed, 18 May 2011, Dan Rosenberg wrote:
> On Wed, May 18, 2011 at 4:29 PM, maximilian attems <max@...o.at> wrote:
> > On Wed, May 18, 2011 at 04:13:05PM -0400, Dan Rosenberg wrote:
> >> Might it be worth fixing the insecure temporary file usage?
> >>
> >> 122 snprintf(fn, sizeof(fn), "/tmp/net-%s.conf", dev->name);
> >> 123 f = fopen(fn, "w");
> >>
> >> What if someone else has already created that file, or put a symlink
> >> or hard link there?
> >
> > for the initramfs case I don't see how.
> > outside of initramfs usage I'd agree that this needs fixing.
> >
>
> Right, this only applies after boot is done.
As klibc main target is initramfs usage this use case hasn't come up much,
so wasn't top priority. Just got reminded today by checking ipconfig
backlog patches.
> >> What if someone overwrites your string with
> >> command injection characters despite your stripping?
> >
> > please be more verbose, what example do you have in mind?
> >
>
> Sorry for not being clear. If you're concerned about scripts parsing
> this file while it has command injection strings in it, what's to stop
> someone from putting a malicious file there if one doesn't already
> exist? It sounds like the scripts that depend on this file should
> probably be fixed here, or the file itself should be moved to a
> location where it's not writable by unprivileged users.
ipconfig in latest klibc git uses /run as you suggested.
http://git.kernel.org/?p=libs/klibc/klibc.git;a=summary
thank you.
--
maks
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
