Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Thu, 13 Jun 2024 09:12:02 +1000
From: Matthew Fernandez <matthew.fernandez@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: Re: CVE-2024-35235 cups: Cupsd Listen arbitrary
 chmod 0140777



On 6/13/24 08:49, Tavis Ormandy wrote:
> On 2024-06-11, Zdenek Dohnal wrote:
>>   ???????? Impact
>>
>> Given that cupsd is often running as root, this can result in the change
>> of permission of any user or system files to be world writable.
>>
>>
>> https://github.com/OpenPrinting/cups/commit/a436956f3
>>
> 
> This is a pretty confusing description... if we accept the premise that an
> attacker can somehow get root to run cupsd with a modified configuration
> file (how???), then this patch doesn't seem sufficient. They can still
> get root to unlink() an arbitrary file, no?

Also with debug printing enabled `DEBUG_printf` does not 
save-and-restore `errno` and then does numerous things that can 
overwrite it. So presumably the `errno == ENOENT` branch is not reliable 
in this scenario.

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.