[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 8 Sep 2014 11:22:56 -0400 (EDT)
From: cve-assign@...re.org
To: kseifried@...hat.com
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: Python robotframework - tmp vuln
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
> This is the first of many
The MITRE CVE team obviously has no objection to your use of the
oss-security list for raising new discussion topics such as the
likelihood that a '../tmp/ substring represents a security problem.
The comments below are only about obtaining CVE assignments from
MITRE.
> the reason I'm not assigning CVE's for these is this is a side project
A CVE isn't going to be possible without further analysis explaining
why a vulnerability exists in the specific case. There can't be an
expectation that someone at MITRE is already familiar with the
product, or will read and understand the complete source code as part
of processing an oss-security message.
Items that seem to be missing from the original message include:
1, Is the "merge('../tmp/passing.xml', '../tmp/failing.xml')"
debugging code, or is this code realistically used because a
different piece of software has created passing.xml and failing.xml
files?
2. If there is a realistic situation in which the
"merge('../tmp/passing.xml', '../tmp/failing.xml')" executes, would
the cwd realistically be a first-level directory such as the /root
or /tmp directory?
3. For purposes of risk analysis, is unconstrained use of a ../tmp/
pathname always equivalent to unconstrained use of a /tmp/ pathname?
A possible CVE assignment decision might be:
A. If a different product came with a test suite containing:
test_program > /tmp/merged.xml
then it could have a CVE because /tmp/merged.xml might be a symlink to
an important file.
B. If the test suite were changed to:
test_program > ../tmp/merged.xml
with no constraints, then it could still have a CVE, because some
people run test suites as root with a cwd of the /root directory.
C. If ../tmp/ is used in "debugging code" that is intended to be run
by a developer who understands the appropriate cwd, and this
"debugging code" is not a "test suite" for users, then there is no CVE
assignment. Admittedly, there might be cases where the distinction
between "debugging code" and "test suite" is completely ambiguous.
- --
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)
iQEcBAEBAgAGBQJUDclfAAoJEKllVAevmvms2jkH/1C3j3ktLAJgRu3lW6z2J55r
7Xr7zd5mJQ9lrVg1HchoUx0l9mLPX5vKwlb43K2xg2vHDFFcL2VKFmEycHo5nfl+
wt2VDwjsQ5S/6fjMcX6wZoNnY0kU5/xdiVUX2g5UAdbLip3VUVosqlsvpZBRwy67
qWJS+IWftsUWp+1tf6i5Pp2TnLlfaiDRGnqOUJ4sccOUVkagwEBNoPZvdZ9bkuin
wm7lVkwNBLIfbt/bbMFWmkeePoZgK2gHxGXpYlJNbvbAgUHcyEW8gNkS5uVEC+mP
GMEoaS1H8wGu9r7GRN4hXJt71dOIU0LxVTpbsk6RNQN5msUR7h2Ft5p8pTwfh5c=
=vfNO
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
