Date: Tue, 13 Sep 2011 21:36:47 +0200 From: Moritz Muehlenhoff <jmm@...ian.org> To: oss-security@...ts.openwall.com Subject: Re: CVE request: heap overflow in tcptrack < 1.4.2 On Wed, Aug 31, 2011 at 06:35:45PM -0400, Steven M. Christey wrote: > > I'm wondering if this should have received a CVE. > > https://bugs.gentoo.org/show_bug.cgi?id=377917 quotes upstream: > > "This fixes a heap overflow in the parsing of the command line... > this may have security repercussions if > tcptrack is configured as a handler for other applications that can > pass user-supplied command line input to tcptrack." > > The "attack" is through a command line argument. While it's listed as a > sniffer, the above text suggests that tcptrack might not be > setuid/privileged, since the only given scenario is "as a handler for > other applications." Unless this is a typical/known scenario, this seems > like just another unprivileged application, in which case the control > over a command line argument would not directly cross privilege > boundaries, thus falling into the realm of "bug" and not "vulnerability." FWIW, we're treating it as a non-security issue in Debian. Cheers, Moritz
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.