Date: Thu, 16 Apr 2015 01:20:11 -0400 (EDT) From: cve-assign@...re.org To: huzaifas@...hat.com Cc: cve-assign@...re.org, oss-security@...ts.openwall.com Subject: Re: Problems in automatic crash analysis frameworks -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > IMO two CVEs are required: > > "Various symlink flaws in abrt" and "Various race conditions in abrt" For purposes of CVE, a set of vulnerabilities related to symlink following normally isn't assigned two CVE IDs solely because some of the symlink attacks depend on a race condition, whereas other symlink attacks don't depend on a race condition. The specific exploitation scenario disclosed in raceabrt.c is about replacing maps with a symlink to /etc/passwd and then waiting for the next line of the code to chown /etc/passwd. This requires symlink following, and will have the same CVE ID as other issues that require symlink following. If the only goal of an attacker were to delete the maps file in order to cause data loss, then we think that attacker does not need to win a race. That attacker can delete the maps file either before or after the chown. (It's also conceivable that file deletion, by itself, was considered an acceptable risk, and not a valid attack goal.) However, the text of http://openwall.com/lists/oss-security/2015/04/14/4 said "is vulnerable to a filesystem race where a user unlinks the file." That's why we asked about the possibility of another scenario in which: 1. The ultimate goal is only to unlink the file. 2. Achieving this ultimate goal requires winning a race. We think there's isn't any such scenario, but we wanted to confirm that before doing a CVE mapping. If there isn't any such scenario, then the total number of CVE IDs for the whole "Furthermore, Abrt suffers" section will be 1. - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (SunOS) iQEcBAEBAgAGBQJVL0V/AAoJEKllVAevmvmsNBgH/1cm1EzfPto2c5q9CF9fSd7v MJ3O/53tfiuWGrWecFyFtn5NsAXb3t35TEioQe6EbDDmEO+ogN6xh+lBJSxc0hBI +kTCjza08/6a1+vfgQaHX5zLdXUrA0BXi97Id1gfr+LcelSVMY0yoGfFlE/VvoKN CXNiXu+FtukYMUSwIdmuHvTjmo54yPyMWI3bMRrw+Tt8X4KQq6mpUZKwNKQ8cOMb 1CVXIWSzs7cdVOEWe4xAeqKKbzhfclB4VB6uFRf/As5z6sWBcvY3sQMUfvvcw0yS 3rQ0LU90yq1rjnUGID4ckzFhV7o9h/AdshYrfi15SmdcR3G5TaKFs2fEkP5PZR0= =h2Xd -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ