Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 30 Oct 2015 15:34:22 -0400
From: Rich Felker <dalias@...c.org>
To: oss-security@...ts.openwall.com
Cc: gustavo.grieco@...il.com, cve-assign@...re.org
Subject: Re: Re: Pointer misuse unziping files with busybox

On Thu, Oct 29, 2015 at 02:04:51AM -0400, cve-assign@...re.org wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA256
> 
> > http://git.busybox.net/busybox/commit/?id=1de25a6e87e0e627aa34298105a3d17c60a1f44e
> 
> > Unziping a specially crafted zip file results in a computation of an invalid
> > pointer and a crash reading an invalid address.
> 
> Could you please comment directly about the likelihood of
> exploitability for code execution? See the
> http://www.openwall.com/lists/oss-security/2015/10/11/5 post. We
> currently feel that a CVE assignment for a non-exploitable unzip crash
> on BusyBox may be unlikely, because BusyBox wouldn't realistically be
> used for deployment of a program that remains running to offer an
> unzipping service to multiple clients.

There are several distributions including Alpine Linux, widely used in
container environments, which by default use busybox to provide the
unzip utility. Unzipping of any files downloaded by the user, possibly
from untrusted sources, may be affected. I believe CVE is appropriate
for user-facing programs commonly used to open untrusted files even
without an automated process accepting and processing
potentially-malicious files from a client.

Rich

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ