Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sat, 08 Nov 2014 00:23:55 +1100
From: Joshua Rogers <>
Subject: Re: Re: CVE-Request: dpkg handling of 'control' and
 warnings format string vulnerability

On 08/11/14 00:14, Sven Kieske wrote:
> to quote the man page of dpkg:
>> --no-act, --dry-run, --simulate Do everything which is supposed to
>> be done, but don't write any changes. This is used to see what
>> would happen with the specified action, without actually modifying
>> anything.
> So the users assumes this does not "modify anything"
> and if I understood this bug correct this gives at least
> access to the stack and allows to write/read memory.
Yes, you understood the bug correctly.

In reality, the vuln/bug is not a huge one. People _normally_ download
.deb files to install them.
But in some cases, that isn't always true.
If the bug was triggered before apt's signature handling, then it could
be a huge one. But it isn't(I'm guessing...)

And as I said, what if another program that, for example, integrates
with a browser, uses dpkg to analyze the .deb file.

The bug itself isn't confined to the -i flag either. It's in the
handling of the warnings. i.e very easy to trigger.

I'm taking a guess here, and going to say that there are other ways of
passing  arbitrary strings to the warning function. I may be wrong though.

-- Joshua Rogers <>

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.