Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 20 Sep 2012 16:10:14 +0200
From: Tomas Hoger <thoger@...hat.com>
To: oss-security@...ts.openwall.com
Cc: geissert@...ian.org
Subject: Re: CVE request: opencryptoki insecure lock files
 handling

On Wed, 12 Sep 2012 12:42:17 -0500 Raphael Geissert wrote:

> > When do pkcsslotd does that, and which version?  It does not happen
> > on its start or stop, or when client as pkcsconf queries for some
> > data.
> 
> I apparently confused it with another set of CreateXProcLock and 
> XProcUnLock's. pkcsslotd indeed doesn't seem to chmod spinloc.

Ok, so I think we need 1 CVE for the two insecure temporary file uses,
unless we want to split each temporary file issue under a separate
CVE.  I don't believe there's a real need to assign CVE for 2.4.1
(which did not improve things on systems with world writable /var/lock)
or 2.4.2 (which re-opens the attack for pkcs11 group members on systems
with restricted /var/lock, but improves things on systems with world
writable /var/lock).

-- 
Tomas Hoger / Red Hat Security Response Team

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.