Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 5 May 2011 10:04:08 -0400 (EDT)
From: "Steven M. Christey" <coley@...-smtp.mitre.org>
To: oss-security@...ts.openwall.com
Subject: Re: Symlinks and filesystem recursion vulnerabilities:
 Action needed or ignore?


Assuming I understand the issue correctly, there is precedent in CVE for 
this kind of problem, or at least the exploitation of recursive 
backup/archive programs as they process files (many seem related to 
setting insecure permissions during the copy, and only setting the secure 
permissions afterward, a la CWE-689).

CVE-2009-4411 is the only example I can easily find.

There is a "risk" of sorts to the community that a large number of these 
issues could get disclosed for different packages in a short timeframe, 
but this happens with any discovery of a new "class" of security problems 
or attacks (look at the untrusted path stuff that happened last year with 
Windows and Linux).  But IMO, better sooner rather than later.  Linux is a 
multi-user OS and should be treated as such, which means local 
file-writing/privilege attacks matter, even though they might not be as 
severe as other kinds of attacks.  Somebody audited simpler symlink 
problems in Debian packages a couple years ago, but while it must have 
been very painful and there were dozens (hundreds?) of separate issues, 
most of those problems seemed to get fixed in a relatively quick amount of 
time.

Maybe the appropriate strategy is for the community to agree on a good way 
of solving these problems before announcing all the different packages 
that are affected, but it's just a thought.  Ultimately this decision is 
up to the researcher, affected developers, and customers.

- Steve

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.