Date: Tue, 25 Feb 2014 08:07:55 -0500 (EST) From: cve-assign@...re.org To: henri@...v.fi Cc: cve-assign@...re.org, oss-security@...ts.openwall.com Subject: Re: CVE request: hexchat buffer overflow -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Are there realistic circumstances in which this crosses privilege boundaries? The primary reference is mentioned at the top of hexchat-overflow.txt but wasn't directly listed in the CVE request: > http://www.mattandreko.com/2013/04/06/buffer-overflow-in-hexchat-294/ > It was super low severity > I decided to try to make a working exploit out of this for fun. > sometimes you just need to escalate privileges locally. If the HexChat > process is running as a privileged user, you can exploit it to gain > access to that user's permissions. > > This exploit was mostly just a fun experience to create. However, did > you think of other attack vectors, such as web links using the irc:// > handler? Perhaps an attacker could fabricate a url that when the user > clicks it, it exploits HexChat. > of course the irc:// handler has nothing to do with the input box > AFAIK, which you "exploited" here. We generally haven't been making CVE assignments for cases of desktop applications in which crafted input is entered interactively in the UI. The existence of a well-known flaw type (e.g., buffer overflow) and the existence of code to generate the crafted input haven't been considered relevant in the past. Is the nature of the attack different here? - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (SunOS) iQEcBAEBAgAGBQJTDJSwAAoJEKllVAevmvmshvEIAJvW7EHnYSuHbJJ8O3WZTfKn cuR/O+4LYq7lEHAhpDB3eD4tPPbvfTj57OfHt/LAH4Wk517N9/AVecWcnqh8i6tG 8Aq1a63bFd86tGkpqkJswcFS0VGrGXAFvvPuoVDe3CJZfcSLv+zaNW1B2kOYeGg8 0ZQTolo3itjA50zEpB8fHHRkKHRPL9D0H/WGG0wDimvNvnwYlIlYHmXBQcUrIgAg HmHo5VSnWvRudiSSnh1NCPtGiAsBCCC9DgtFepEnd/XiogL/7fQ3FvCap14pjVGe BMV+tUD47aEBHnwEj18Tl6NlbmdKgOLxUDULLso0XZMdoSZpL6Q+MyDVYqdghTA= =OhXv -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ