Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 4 Sep 2008 13:07:08 -0400 (EDT)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: oss-security@...ts.openwall.com
Subject: Re: GNU ed heap overflow


Use CVE-2008-3916... with caveat.

While everything's inter-connected these days and maye ed can be invoked
from some URI handler, or behind some application that passes user input
to ed, I'm generally uncomfortable assigning a CVE for this type of "local
issue" unless there's a reasonable usage scenario under which the
application is reachable (WordNet has reasonable usage scenarios as a back
end, for example).


======================================================
Name: CVE-2008-3916
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3916
Reference: MLIST:[bug-ed] 20080821 Version 1.0 of GNU ed released
Reference: URL:http://lists.gnu.org/archive/html/bug-ed/2008-08/msg00000.html
Reference: SECTRACK:1020734
Reference: URL:http://www.securitytracker.com/id?1020734
Reference: XF:gnued-stripescapes-bo(44643)
Reference: URL:http://xforce.iss.net/xforce/xfdb/44643

Heap-based buffer overflow in the strip_escapes function in signal.c
in GNU ed before 1.0 allows context-dependent or user-assisted
attackers to execute arbitrary code via a long filename.  NOTE: since
ed itself does not typically run with special privileges, this issue
only crosses privilege boundaries when ed is invoked as a third-party
component.


Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.