[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sat, 08 Nov 2014 00:23:55 +1100
From: Joshua Rogers <oss@...ernot.info>
To: oss-security@...ts.openwall.com
Subject: Re: Re: CVE-Request: dpkg handling of 'control' and
warnings format string vulnerability
On 08/11/14 00:14, Sven Kieske wrote:
> to quote the man page of dpkg:
>
>> --no-act, --dry-run, --simulate Do everything which is supposed to
>> be done, but don't write any changes. This is used to see what
>> would happen with the specified action, without actually modifying
>> anything.
> So the users assumes this does not "modify anything"
> and if I understood this bug correct this gives at least
> access to the stack and allows to write/read memory.
Yes, you understood the bug correctly.
In reality, the vuln/bug is not a huge one. People _normally_ download
.deb files to install them.
But in some cases, that isn't always true.
If the bug was triggered before apt's signature handling, then it could
be a huge one. But it isn't(I'm guessing...)
And as I said, what if another program that, for example, integrates
with a browser, uses dpkg to analyze the .deb file.
The bug itself isn't confined to the -i flag either. It's in the
handling of the warnings. i.e very easy to trigger.
I'm taking a guess here, and going to say that there are other ways of
passing arbitrary strings to the warning function. I may be wrong though.
Thanks,
--
-- Joshua Rogers <https://internot.info/>
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
