Date: Fri, 26 Aug 2011 15:14:33 -0500 From: Jamie Strandboge <jamie@...onical.com> To: geoff@...ttered.org, dwyer@...lab.ee.mu.oz.au, jgifford@...ksmart.net Cc: oss-security@...ts.openwall.com, security@...ntu.com Subject: Security issue in hammerhead A security bug was reported against hammerhead in Ubuntu. You are being emailed as the upstream contact. Please keep oss-security@...ts.openwall.com CC'd for any updates on this issue. This issue should be considered public and has not yet been assigned a CVE. Details from the public bug follow: https://launchpad.net/bugs/826679 ---- From the reporter: "hammerhead blindly writes to to /tmp/hammer.log without prior checks. It is possible to put a symbolic link at /tmp/hammer.log pointing at another file - that hammerhead will then end up appending data into. (it appears that hammerhead uses the file location as specified in /etc/hammerhead/hh.conf - which in debian/ubuntu is /tmp/hammer.log)." ---- A quick check shows that HH_LOG and REPORT_LOG are indeed being unconditionally opened with 'fopen(..., "a+")' in src/hammerhead.cc. Thanks in advance for your cooperation in coordinating a fix for this issue, Jamie Strandboge  oss-security@...ts.openwall.com is a public mailing list for people to collaborate on security vulnerabilities and coordinate security updates. PS - I couldn't find a security contact for hammerhead, so emailed to those I could find in AUTHORS. -- Jamie Strandboge | http://www.canonical.com Download attachment "signature.asc" of type "application/pgp-signature" (837 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.