Date: Fri, 30 Oct 2015 15:34:22 -0400 From: Rich Felker <dalias@...c.org> To: oss-security@...ts.openwall.com Cc: gustavo.grieco@...il.com, cve-assign@...re.org Subject: Re: Re: Pointer misuse unziping files with busybox On Thu, Oct 29, 2015 at 02:04:51AM -0400, cve-assign@...re.org wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA256 > > > http://git.busybox.net/busybox/commit/?id=1de25a6e87e0e627aa34298105a3d17c60a1f44e > > > Unziping a specially crafted zip file results in a computation of an invalid > > pointer and a crash reading an invalid address. > > Could you please comment directly about the likelihood of > exploitability for code execution? See the > http://www.openwall.com/lists/oss-security/2015/10/11/5 post. We > currently feel that a CVE assignment for a non-exploitable unzip crash > on BusyBox may be unlikely, because BusyBox wouldn't realistically be > used for deployment of a program that remains running to offer an > unzipping service to multiple clients. There are several distributions including Alpine Linux, widely used in container environments, which by default use busybox to provide the unzip utility. Unzipping of any files downloaded by the user, possibly from untrusted sources, may be affected. I believe CVE is appropriate for user-facing programs commonly used to open untrusted files even without an automated process accepting and processing potentially-malicious files from a client. Rich
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.