Date: Fri, 18 Jul 2014 21:39:08 -0400 (EDT) From: cve-assign@...re.org To: kseifried@...hat.com Cc: cve-assign@...re.org, oss-security@...ts.openwall.com Subject: Re: CVE's for intersection vulnerabilities -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > But then we have #4: Yes, see CVE-2014-4039 in http://openwall.com/lists/oss-security/2014/06/17/1 and http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4039 Here, a technical-support tool (very similar in purpose to sosreport) makes a copy of a mode 0600 /var/log/messages file within a (potentially) mode 0644 /tmp/diagSEsnap/snapH.tar.gz archive file. There can realistically be usernames and passwords in /var/log/messages, at least when that log file is used by poorly written site-specific software. Thus, a CVE can be assigned. A CVE could also be assigned if there wasn't a mode 0644 local file, but the archive containing /var/log/messages was transmitted externally in a "technical-support data stream" (as in CVE-2014-4040). Incidentally, some vendors assign a CVE ID if one of their products logs a password to a file that has default permissions of 0600, even if the vendor's documentation says that the customer must not change the permissions. Their rationale is that the password logging was a security-relevant implementation error. At some point, it comes down to the vendor understanding its own customers. If they know that customers ignore the documentation and use 0644 instead, this would be a reasonable motivation for declaring the coding error to be security-relevant. - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (SunOS) iQEcBAEBAgAGBQJTycv7AAoJEKllVAevmvms/lgIAKS6Vp9JEI+3JhXeoaAAIF2n CvwnK1wha7RF25+T5xBG3S+5BBVe0fl6OL5w9HQxtVk9XMF8Wo3qsGbUHWtMwrlY PncO/hc6UA5ZeMS5Hhv4xD/GYbVgpW4Y485daCdP6aUdmbUeDr0iuUlYJN/VjvEd +zTvc+8i4Fa43VhGXLXGr9uUxgmlKcewzvOYkVwrxttPjyLM1T5o225/u4zMPeo+ 9UTPbRYx0vwB0OFsN/8+CvklcyYXGIR9joXr8uFp01IRzpb5uiywuv1aMDppIF3w 5BqCYjLRBXpBorvRhKX6jiui2iX+t+7Yv4jpO3iEhTDXqsYenqqCfG9Qwt/K9RE= =9uMS -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.