Date: Tue, 22 May 2012 12:11:19 -0600 From: Kurt Seifried <kseifried@...hat.com> To: oss-security@...ts.openwall.com CC: maximilian attems <max@...o.at>, Dan Rosenberg <dan.j.rosenberg@...il.com>, klibc@...or.com Subject: Re: Re: [klibc] CVE request: klibc: ipconfig sh script with unescaped DHCP options -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 05/22/2012 11:30 AM, Kurt Seifried wrote: > On 05/22/2012 03:18 AM, maximilian attems wrote: >> On Wed, 18 May 2011, Dan Rosenberg wrote: > >>> On Wed, May 18, 2011 at 4:29 PM, maximilian attems >>> <max@...o.at> wrote: >>>> On Wed, May 18, 2011 at 04:13:05PM -0400, Dan Rosenberg >>>> wrote: >>>>> Might it be worth fixing the insecure temporary file >>>>> usage? >>>>> >>>>> 122 snprintf(fn, sizeof(fn), "/tmp/net-%s.conf", >>>>> dev->name); 123 f = fopen(fn, "w"); >>>>> >>>>> What if someone else has already created that file, or put >>>>> a symlink or hard link there? >>>> >>>> for the initramfs case I don't see how. outside of initramfs >>>> usage I'd agree that this needs fixing. >>>> >>> >>> Right, this only applies after boot is done. > >> As klibc main target is initramfs usage this use case hasn't >> come up much, so wasn't top priority. Just got reminded today by >> checking ipconfig backlog patches. > >>>>> What if someone overwrites your string with command >>>>> injection characters despite your stripping? >>>> >>>> please be more verbose, what example do you have in mind? >>>> >>> >>> Sorry for not being clear. If you're concerned about scripts >>> parsing this file while it has command injection strings in >>> it, what's to stop someone from putting a malicious file there >>> if one doesn't already exist? It sounds like the scripts that >>> depend on this file should probably be fixed here, or the file >>> itself should be moved to a location where it's not writable >>> by unprivileged users. > >> ipconfig in latest klibc git uses /run as you suggested. >> http://git.kernel.org/?p=libs/klibc/klibc.git;a=summary > >> thank you. > > > Please use CVE-2012-2382 for this issue. Please REJECT CVE-2012-2382, this is a duplicate of CVE-2011-1930, I didn't check far back enough (my bad). The original (correct assignment) is here: http://seclists.org/oss-sec/2011/q2/460 Thanks to the security vendor that pointed this out (they did not want public credit). - -- Kurt Seifried Red Hat Security Response Team (SRT) PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iQIcBAEBAgAGBQJPu9bHAAoJEBYNRVNeJnmTL8IQAIMEzlm10PF1VYv93J5QBeOI DiDrhGc91MucGviPU4SXJiha+YvV9zuEJfxiuaStR15XhkzHN9k4c89aQgmTHaVH lYbRMM8qCdhUyH9yz5br496riH8O7tVAdFE+cDoWo3JSmN+rRplN+Y4ibPduKY/B vfaw+GowQWT5Ff0cm75iWNuiW+agnktJIZODeOwoO2NJl6hXewAPdkE2CjMTNB21 6WdLk47qXngVKum6KvhnBPG24IYJeNsi1P8rscATc01XqWgRXmeC94rLUWkXWbsX i8OgynKJtNQqP6luEa1mi5PauHviFsYHBYc4pRzvSIU4Gxl7N2cFO7Tf7mi45Qpm kY1bcAG7aVWCqLiqwI40JOZ9Z4FY3p/dboXaI8GmVbK06eMjjeBDlUx0C5xFZ9qJ Sn8tWbGkHaHfLMxInrc8yeYUVQ4u+NMs7NFyzCBDhNP7uN+8HhJqMTvCsEOlSIxP jIXbjI8NZ++eaLNGQyn0RtOa2+Z17XVKE+CoS+H4pfxGX66U/lHtRfxktkG5o9gH Cs5LIJMfbF3AOJ5uER9I5sqPw4qOCPQr5ip5jyamCTveYl4EcXAJsAdGOwIhuQB8 4sfr49Bu2yItyj9+SBShk5JUVscYsZiPXPhP8WrtUnI9J72dvuwgFkZM8vyh1PPv bV1/9OFluB7Pkmz98j06 =Yn84 -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.