Date: Mon, 7 Jun 2010 10:46:10 -0400 (EDT) From: "Steven M. Christey" <coley@...us.mitre.org> To: oss-security@...ts.openwall.com cc: Guillem Jover <guillem@...ian.org>, Aníbal Monsalve Salazar <anibal@...ian.org>, "Steven M. Christey" <coley@...us.mitre.org> Subject: Re: CVE Request -- rpcbind -- Insecure (predictable) temporary file use On Fri, 4 Jun 2010, Josh Bressers wrote: > Please use CVE-2010-2061 for this. My read of Guillem's report at http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=583435#5 suggests that we might have two distinct issues here: - "*any* user can craft those two files before the daemon has started for the first time, which the daemon will parse." Nothing to do with symlinks. - symlinks are followed on creation of those files So we may need two CVEs here. - Steve
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.