oss-security - CVE Request: cups: Incomplete fix for CVE-2014-3537

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20140722045904.GB25519@lorien.valinor.li>
Date: Tue, 22 Jul 2014 06:59:04 +0200
From: Salvatore Bonaccorso <carnil@...ian.org>
To: OSS Security Mailinglist <oss-security@...ts.openwall.com>
Cc: Michael Sweet <msweet@...le.com>, odyx@...ian.org,
	CVE Assignments MITRE <cve-assign@...re.org>
Subject: CVE Request: cups: Incomplete fix for CVE-2014-3537

Hi

CVE-2014-3537 was allocated for http://www.cups.org/str.php?L4450
(Insufficient checking leads to privilege escalation). The intention
in the fix was to dissalow symlinks.

With the fix applied fo CVE-2014-3537 this is still possible in some
cases (where language[0] is null), see https://cups.org/str.php?L4455

Additionally Michael Sweet wrote: 

> Yes, it looks like this needs to be an lstat as well, and we should
> probably add similar protections to the directory index files (which
> are also using stat).

Could a CVE be assigned to identify this? (Question: one CVE should be
enough for the additional fix for all the missing remaining lstat?).

Regards,
Salvatore

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.