Date: Fri, 4 Mar 2011 13:14:51 -0500 From: Dan Rosenberg <dan.j.rosenberg@...il.com> To: oss-security@...ts.openwall.com Cc: "Steven M. Christey" <coley@...-smtp.mitre.org>, Florian Zumbiehl <florz@...rz.de>, Stefan Fritsch <sf@...itsch.de>, Jan Kaluza <jkaluza@...hat.com>, Paul Martin <pm@...ian.org>, Petr Uzel <petr.uzel@...e.cz>, Thomas Biege <thomas@...e.de>, Jan Lieskovsky <jlieskov@...hat.com> Subject: Re: CVE Request -- logrotate -- nine issues > >> It felt wrong, say, to blame a text editor for being unsafe to use on >> files in untrusted directories when such unsafety was the typical and >> expected situation for text editors in general. > > Some items can be assigned a CVE without deep thought about the larger > context. This may happen due to volume, time constraints, or an > under-specified attack scenario by the requester. That may be the case with > the case you're talking about here, but I don't remember it. > Just to chime in here about parallels to the GNU nano case you're referring to. I agree with you that a CVE for those issues may have been unnecessary, but it depends on your expectations of what guarantees a text editor provides. If I try to open an untrusted file with a text editor, and an attacker replaces that file before I open it, resulting in me making edits to the wrong file, then of course that's not a security issue, because the text editor did exactly what it was told to do: open the file, which happened to be different by the time it got around to opening it. There would also be visual feedback in the text editor to alert the user as to which file was being edited. However, if I open a file to edit, and someone changes that file out from under me while I'm making edits, and a resulting save overwrites the new underlying file, including following symlinks, that's slightly different, since one might argue that some feedback or warning from the editor would be expected (this is the case with almost all other text editors). But this is subtle, and I understand both sides of the argument - personally, I don't think it's a serious enough attack vector to warrant splitting hairs over. The logrotate case is even more subtle, since it's even less clear what constitute reasonable expectations with regards to the security guarantees of the application. -Dan
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.