Date: Tue, 14 Apr 2015 11:55:15 -0400 (EDT) From: cve-assign@...re.org To: oss-security@...ts.openwall.com Cc: cve-assign@...re.org Subject: Re: Problems in automatic crash analysis frameworks -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 This is mostly a question for the persons who assigned CVE-2015-1318 and CVE-2015-1862. Should these CVE assignments be interpreted to mean: CVE-2015-1318 - in Apport, an unprivileged user can use a namespace-based attack because there is an execve by root after a chroot into a user-specified directory CVE-2015-1862 - in ABRT, an unprivileged user can use a namespace-based attack because there is an execve by root after a chroot into a user-specified directory with "Furthermore, Abrt suffers from numerous race conditions and symlink problems" not yet mapped to any CVE IDs? (CVE-2012-5660 is a similar but older issue.) These additional ABRT issues would seem to be, for example, independently relevant on a system where the kernel was built without namespaces support. However, the raceabrt.c attachment says "This is a race condition exploit for CVE-2015-1862." - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (SunOS) iQEcBAEBAgAGBQJVLTexAAoJEKllVAevmvmsjqcH/2QSrlMTNp+0ovd4FKrMM3W2 p2R2WeHGkhEodzZJEFtCPit+K8hPEU7PFsX6ZIxM2mY6eQkKkbvBTSbBGzWB92Du eqaU9uFXeELo0cqQDws9AyrwoD4YA4EcA84oaEqSpzRUk1YrdV2nQWP5n5/htKV1 aZmlclshZcecd7PkwxhZh4/+5yinktXnZd72c4MW3QUCmYBnGQjuHGPzJhAKFg13 PBqyFkUkFnZSA3vhl2gPgomaAFnvBmciiEGyXngqplUrf7pHK3wWWkQoeZ/AefxO gttXwwFOMGyf6WJ54dJFYc3MpAoXgEr6yg6Ip2eXa64oYfIyFW85hh2Kbe9Vt2M= =77mv -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.