Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 24 Sep 2012 23:50:44 -0500
From: Raphael Geissert <geissert@...ian.org>
To: Tomas Hoger <thoger@...hat.com>,
 oss-security@...ts.openwall.com
Subject: Re: CVE request: opencryptoki insecure lock files handling

On Thursday 20 September 2012 09:10:14 Tomas Hoger wrote:
> Ok, so I think we need 1 CVE for the two insecure temporary file uses,
> unless we want to split each temporary file issue under a separate
> CVE.  I don't believe there's a real need to assign CVE for 2.4.1
> (which did not improve things on systems with world writable /var/lock)
> or 2.4.2 (which re-opens the attack for pkcs11 group members on systems
> with restricted /var/lock, but improves things on systems with world
> writable /var/lock).

I think two ids is more appropriate given that the issue isn't fixed in 2.4.1 
for systems with world writable /var/lock. 2.4.2, on the other hand, covers 
boths scenarios (given that pkcs11 group membership is already considered 
root-equivalent.)

Regards,
-- 
Raphael Geissert - Debian Developer
www.debian.org - get.debian.net

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.