[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Fri, 01 Mar 2013 18:14:01 -0700
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security@...ts.openwall.com
CC: Marcus Meissner <meissner@...e.de>
Subject: Re: CVE Request: rubygem passenger security issue
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 03/01/2013 09:46 AM, Marcus Meissner wrote:
> Hi,
>
> https://bugzilla.novell.com/show_bug.cgi?id=804722
> https://github.com/FooBarWidget/passenger/commit/8c6693e0818772c345c979840d28312c2edd4ba4#commitcomment-2643541
>
> Quoting:
>
> There is a security issue regarding passenger that has been fixed
> in master. However, this does only apply if you deploy arbitrary
> untrusted apps on you server. Very unlikely for us but still I
> thought it was worth to inform you.
>
> It fixes a security issue, but unless you're on a shared
> environment it's not a grave issue. It allows an application
> process to delete an arbitrary file, even a file it does not have
> permi ssion to, but only during application startup (i.e. during
> evaluation of config.ru). Once the application is started, it
> cannot be exploited, so external visitors cannot influence this. If
> you deploy arbitrary untrusted apps on your server then this issue
> can be a problem. If all your apps are trusted (e.g. because your
> organization wrote) them then there's no problem.
PaaS. Third party apps, etc. I'm gonna go with a yes. Just because you
deploy a poorly written/hostile app doesn't mean it should be able to
hose your system completely.
Please use CVE-2012-6135 for this issue.
> Unquote
>
> I am not sure this warrants a CVE.
>
> Ciao, Marcus
>
- --
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)
iQIcBAEBAgAGBQJRMVJZAAoJEBYNRVNeJnmTTy0P/1L2D/jZW2Tfu3VHUCkZGIGj
F7tV0XRR0WM4U+ODOKXXbuaefxHfPk7jJbQH0nfSa01KXCE/RwO/Qm482w/3KeHD
LXASONIfc1IQnTOWFTA7wMToB2m/P4MWFJNmKeDZEbYxVshBpuzLsN6ZKQghntaG
ArHtHN1ul8A2ZD7o8aDHR7s9Jh5ml60MgFtzujUcX4eL25JdD6TLoMxywlob8WVo
YWKgmCGbYrpIsz7m1xbEtrKw2v/F1l91E24HXILa/FcpRr6Wn2VLnyMA58XR7rKR
JAh6dbSG58X9hlu2DMXWWvcFvVozmNoqQo23AXtRzdC/CIoau750Pw8g1PftDAk8
20CCM6yFwhFrRQZPvPa/VpD6mAzGfbdzWhGqI3og04SGyA3quKA5tmohenO3ouOB
ezQiM2fseYNxOh/ru1UTxh8FXOgeKs4kizj6BCdwoNrxOycMwA5Etm8XU4Lmrg1q
w9Wtwz9cZ0d/X76HNJhIY/+QeT+52AQZlDfNMxx2PZ9fL0Y8xJuD5Z+Ap1j/pSui
Rbt90I6eKEfbcTD7ATcyvFWZsTMdx6rUPTGihX9UEYhlYqV0rK8GLuJRr8x6/moE
DHApL7DNeGjoCHg96BfzegV+c0ps9V5tg6zeoey3bVMCU3pJDmf5psDtjC10kyVZ
vRLgujtWhoVcvsypttTe
=eLao
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
