Date: Thu, 16 Oct 2008 12:40:46 -0400 From: "John Dong" <jdong@...ntu.com> To: "Steven M. Christey" <coley@...us.mitre.org> Cc: oss-security@...ts.openwall.com, "Jamie Strandboge" <jamie@...onical.com> Subject: Re: CVE request: jhead On Wed, Oct 15, 2008 at 2:28 PM, Steven M. Christey <coley@...us.mitre.org>wrote: > > On Wed, 15 Oct 2008, Jamie Strandboge wrote: > > > CC'ing John, as he is who found the majority of the issues and > > coordinated with upstream. > > So the jhead changelog only acknowledges "potential string overflows". > > John's comment in bug 271020 alludes to various other types of issues, but > specifics are unknown. And there are some references to other overflows > that may or may not have been fixed by upstream. > > So, we'd need multiple CVEs, but how many is unclear. > > 1 - long -cmd > 2 - unsafe temp file creation > 3 - "more unchecked buffers" and "unsafe buffer sized strcat's in > ModifyDescriptComment" [this assumes that upstream only fixed > issue 1) > 4 - shell escapes > > > Without knowing what exactly is being reported and fixed, it's pretty > difficult to assign CVEs, especially with phrases like "more unchecked > buffers" that could apply to anything. Hi Steven, Sorry for the delay. I just had a chance to look over the diff of the new 2.84 release. I see that the long cmd and all the unchecked buffers I found were resolved by use of length-checked strcat functions. In addition, unsafe tempfile creation was fixed by checking for existence of existing filenames, trying a larger variety of filenames, and erroring out if there is not an empty filename. However, this fix doesn't seem complete for DoCommand where you can trick it to unlink() a file by the name of the input file mangled with the last char of "z" instead of "t" or vice versa. The shell escape potential for DoCommand, as far as I can tell, is also not resolved. So, bottom line is I think 2.84 fixes 1 and 3 acceptably, while 2 and 4 are still unresolved. John
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.