[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 14 Nov 2008 12:35:41 -0500 (EST)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: oss-security@...ts.openwall.com, jlieskov@...hat.com
Subject: Re: CVE id request: htop
Sorry Jan and Nico, I didn't follow up with you on this. There were some
questions about whether this deserved a CVE, since THOUSANDS of programs
dump output without considering whether they're writing to a terminal...
or what they're writing to a terminal.
For example, should the "cat" program become more terminal-aware and avoid
sending dangerous sequences? Which of dozens of different terminal types
should it avoid sending these sequences to? Should it get a new CVE every
time it forgets about some other terminal?
Not to mention "more" and "ls" and "grep" and many others.
We were forced to flag Apache a number of years ago because it didn't
filter certain dangerous characters from its logs. I always felt a bit
funny about that one.
Hopefully you see why this is an edge case for us.
In this specific case, however, apparently top performs this behavior,
it's clearly intended to run in a terminal, *and* a vendor is stating it's
a security issue. So, CVE-2008-5076 has been assigned.
- Steve
======================================================
Name: CVE-2008-5076
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5076
Reference: MLIST:[oss-security] 20081102 CVE id request: htop
Reference: URL:http://www.openwall.com/lists/oss-security/2008/11/02/1
Reference: CONFIRM:http://bugs.debian.org/504144
Reference: XF:htop-processname-weak-security(46321)
Reference: URL:http://xforce.iss.net/xforce/xfdb/46321
htop 0.7 writes process names to a terminal without sanitizing
non-printable characters, which might allow local users to hide
processes, modify arbitrary files, or have unspecified other impact
via a process name with "crazy control strings."
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
