[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 21 Apr 2020 17:41:42 +0000
From: "jellicent@...tonmail.com" <jellicent@...tonmail.com>
To: "info@...nvakil.com" <info@...nvakil.com>
Cc: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: Re: Pacman package manager - taking untrusted input
On Tuesday, April 21, 2020 5:21 PM, Amin Vakil <info@...nvakil.com> wrote:
> Although this is something that can be fixed, it's not a critical
> security issue at all, in all scenarios that has been written if
> database is compromised, the best (worst) thing that malicious actor can
> do is stopping user from installing packages, because he can't create a
> verified gpg signed package which is mandatory for pacman to allow
> installation of the package.
This is incorrect. An attacker need only find a bug in how Pacman does
parsing/reading of the database file to potentially get code execution
on the box as root. See Pacman's CVE history for at least one example
of this. The problem happens before any package signatures come into
play.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
