Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 04 Dec 2014 13:02:03 +0100
From: Florian Weimer <fweimer@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE request: procmail heap overflow in getlline()

On 12/04/2014 11:26 AM, Martino Dell'Ambrogio wrote:
> For what is worth, I strongly believe this is a security bug for the
> same reason.
> As soon as there is an undocumented way to execute code, it will be
> impossible for a .procmailrc file generator to avoid execution of code.
> Workaround measures like security capabilities can not be taken into
> account as they are not implicit.

There are many documented code execution opportunities (some of them 
still rather subtle), so I find any arguments based on the existence of 
a hypothetical secure procmailrc file generator not very convincing.

:0
|echo code execution >/dev/tty

:0
* ?echo code execution >/dev/tty
/dev/null

… and so on.

-- 
Florian Weimer / Red Hat Product Security

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.