Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 16 Apr 2015 01:20:11 -0400 (EDT)
Subject: Re: Problems in automatic crash analysis frameworks

Hash: SHA1

> IMO two CVEs are required:
> "Various symlink flaws in abrt" and "Various race conditions in abrt"

For purposes of CVE, a set of vulnerabilities related to symlink
following normally isn't assigned two CVE IDs solely because some of
the symlink attacks depend on a race condition, whereas other symlink
attacks don't depend on a race condition.

The specific exploitation scenario disclosed in raceabrt.c is about
replacing maps with a symlink to /etc/passwd and then waiting for the
next line of the code to chown /etc/passwd. This requires symlink
following, and will have the same CVE ID as other issues that require
symlink following.

If the only goal of an attacker were to delete the maps file in order
to cause data loss, then we think that attacker does not need to win a
race. That attacker can delete the maps file either before or after
the chown. (It's also conceivable that file deletion, by itself, was
considered an acceptable risk, and not a valid attack goal.)

However, the text of said "is
vulnerable to a filesystem race where a user unlinks the file." That's
why we asked about the possibility of another scenario in which:

  1. The ultimate goal is only to unlink the file.
  2. Achieving this ultimate goal requires winning a race.

We think there's isn't any such scenario, but we wanted to confirm
that before doing a CVE mapping. If there isn't any such scenario,
then the total number of CVE IDs for the whole "Furthermore, Abrt
suffers" section will be 1.

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through ]
Version: GnuPG v1.4.14 (SunOS)


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.