Date: Fri, 25 Nov 2011 16:13:10 +0100 From: Jan Lieskovsky <jlieskov@...hat.com> To: Ludwig Nussel <ludwig.nussel@...e.de> CC: oss-security@...ts.openwall.com Subject: Re: CVE Request: colord sql injections Hi Ludwig, thank you for the report. On 11/25/2011 11:55 AM, Ludwig Nussel wrote: > Hi, > > colord did not quote user supplied strings which made it prone to > SQL injections: > https://bugs.freedesktop.org/show_bug.cgi?id=42904 > https://bugzilla.novell.com/show_bug.cgi?id=698250 Just to have this one sorted out wrt to the patches, the relevant upstream patches are these two:  http://gitorious.org/colord/master/commit/1fadd90afcb4bbc47513466ee9bb1e4a8632ac3b  http://gitorious.org/colord/master/commit/36549e0ed255e7dfa7852d08a75dd5f00cbd270e right? Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Response Team > > When colord runs as root and local active users are allowed to > create new devices (both are the defaults AFAIK) this allows not > only to corrupt colord's own database but also to leverage it to > modify other databases in the system (PackageKit for example also > uses sqlite). > > PoC available on request. > > cu > Ludwig >
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.