[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 18 Jul 2014 21:39:08 -0400 (EDT)
From: cve-assign@...re.org
To: kseifried@...hat.com
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: CVE's for intersection vulnerabilities
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
> But then we have #4:
Yes, see CVE-2014-4039 in
http://openwall.com/lists/oss-security/2014/06/17/1
and
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4039
Here, a technical-support tool (very similar in purpose to sosreport)
makes a copy of a mode 0600 /var/log/messages file within a
(potentially) mode 0644 /tmp/diagSEsnap/snapH.tar.gz archive file.
There can realistically be usernames and passwords in
/var/log/messages, at least when that log file is used by poorly
written site-specific software. Thus, a CVE can be assigned.
A CVE could also be assigned if there wasn't a mode 0644 local file,
but the archive containing /var/log/messages was transmitted
externally in a "technical-support data stream" (as in CVE-2014-4040).
Incidentally, some vendors assign a CVE ID if one of their products
logs a password to a file that has default permissions of 0600, even
if the vendor's documentation says that the customer must not change
the permissions. Their rationale is that the password logging was a
security-relevant implementation error. At some point, it comes down
to the vendor understanding its own customers. If they know that
customers ignore the documentation and use 0644 instead, this would be
a reasonable motivation for declaring the coding error to be
security-relevant.
- --
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)
iQEcBAEBAgAGBQJTycv7AAoJEKllVAevmvms/lgIAKS6Vp9JEI+3JhXeoaAAIF2n
CvwnK1wha7RF25+T5xBG3S+5BBVe0fl6OL5w9HQxtVk9XMF8Wo3qsGbUHWtMwrlY
PncO/hc6UA5ZeMS5Hhv4xD/GYbVgpW4Y485daCdP6aUdmbUeDr0iuUlYJN/VjvEd
+zTvc+8i4Fa43VhGXLXGr9uUxgmlKcewzvOYkVwrxttPjyLM1T5o225/u4zMPeo+
9UTPbRYx0vwB0OFsN/8+CvklcyYXGIR9joXr8uFp01IRzpb5uiywuv1aMDppIF3w
5BqCYjLRBXpBorvRhKX6jiui2iX+t+7Yv4jpO3iEhTDXqsYenqqCfG9Qwt/K9RE=
=9uMS
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
