Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Sun, 30 Jun 2013 16:37:36 -0600
From: Kurt Seifried <>
CC: Alexandre Rebert <>,,
        Russ Allbery <>,
Subject: Re: 1.2k bug reports for Debian, some may be security

Hash: SHA1

On 06/27/2013 09:04 PM, Alexandre Rebert wrote:
> Hi,
> I can confirm most of the bugs have no security implications, and 
> should probably not get CVEs. Given the high number of crashes we 
> found, it is highely likely that some will impact security though.

Please let me know about this laong with impact/etc so I can confirm
they are security related. It's probably easiest to either post the
CVE requests here if the issue is public, if it needs to be private I
suggest using distros@ or emailing me directly. I would also ask that
you notify distros@ of security issues in any event so vendors can
coordinate releases. For more info people see:

> Mayhem considered multiple input sources during the analysis of
> the 23K binaries: environment variables, command line arguments,
> files and standard input. Sockets was not one of them. That means
> that we only need to consider two attack vectors: (1) crashes of
> setuid/setgid programs, and (2) crashes with input files that are
> potentially untrusted.
> For (1), I have not checked whether we found crashes in
> setuid/setgid programs yet. It is however straightforward to
> compile a list and forward it to whoever is filing the CVEs. They
> might not be exploitable, but a crash in such programs is
> concerning and might be worth a CVE. Let me know if that's
> something you'd like us to do.
> For (2), it is difficult to automatically identify such crashes.
> As Steve mentioned, it may require a deep familiarity with the
> program. Package maintainers or upstream developers are the most
> suited people to judge whether a crash should be considered
> security critical. It is an unsatisfying solution, as the burden to
> report vulnerabilities would lie on them, but I don't see a way
> around it.

It's the most efficient, I mean Fedora/Debian/etc all have thousands
(Debian is 50k?) packages, that's a lot of software, asking security
researchers to be intimately familiar with it isn't realistic. Plus
most Open Source upstreams want to secure their code and won't mind

>> I was under the impression from an incomplete read of the MAYHEM
>> paper that it could generate shellcode for code execution, yet
>> I'm only hearing of reports for crashes.  If code execution can
>> be proven, then that may be informative.
> Yes, that is correct. Mayhem actually generated a couple of
> exploits from the crashes we found. We are currently looking at
> them individually, and we will report all exploits that are
> security issues.
> Regards, The Mayhem Team

- -- 
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
Version: GnuPG v1.4.13 (GNU/Linux)


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.