[<prev] [next>] [day] [month] [year] [list]
Message-ID: <7ab551aa-36d6-b99f-175f-5ea8b01c6eeb@gentoo.org>
Date: Thu, 9 Feb 2017 16:33:11 +0100
From: Thomas Deutschmann <whissi@...too.org>
To: oss-security@...ts.openwall.com
Subject: Re: Re: Firejail local root exploit
Hi,
I just received the CVE for the incomplete fix from MITRE via new
webform. Please see the forwarded message below:
-------- Forwarded Message --------
Subject: Re: [scr292978] firejail - Affected <0.9.44.6
Date: Thu, 9 Feb 2017 10:18:58 -0500
The CVE ID is provided below, after the text associated with your
https://cveform.mitre.org submission. The text reflects the current
status of the CVE at MITRE, and may already have minor changes
relative to your form entry. Changes are made in order to capture the
information in the intended presentation format; changes are not an
attempt to revise the results of vulnerability research.
You may republish or redistribute this text. We think that you have
already posted to oss-security about this vulnerability. To make
oss-security list members aware of the CVE ID assignment, you could
reply to your own oss-security post and include pertinent information
below along with the CVE ID.
> [Suggested description]
> firejail before 0.9.44.6 and 0.9.38.x LTS before 0.9.38.10 LTS
> does not comprehensively address dotfile cases during its
> attempt to prevent accessing user files with an euid of zero,
> which allows local users to conduct sandbox-escape attacks
> via vectors involving a symlink and the --private option.
> NOTE: this vulnerability exists because of an incomplete
> fix for CVE-2017-5180.
>
> ------------------------------------------
> [Additional Information]
> This is a fix for the incomplete fix of CVE-2017-5180.
>
> I already tried to request a new CVE on OSS-Sec which wasn't answered
> yet: http://www.openwall.com/lists/oss-security/2017/01/31/16
>
> ------------------------------------------
>
> [VulnerabilityType Other]
> Incomplete fix of CVE-2017-5180
>
> ------------------------------------------
>
> [Vendor of Product]
> https://firejail.wordpress.com/
>
> ------------------------------------------
>
> [Affected Product Code Base]
> firejail - Affected <0.9.44.6
> firejail-lts - Affected <0.9.38.10
>
> ------------------------------------------
>
> [Attack Type]
> Local
>
> ------------------------------------------
>
> [Impact Escalation of Privileges]
> true
>
> ------------------------------------------
>
> [Reference]
> https://firejail.wordpress.com/download-2/release-notes/
> https://github.com/netblue30/firejail/commit/38d418505e9ee2d326557e5639e8da49c298858f
> https://github.com/netblue30/firejail/commit/b8a4ff9775318ca5e679183884a6a63f3da8f863
> https://github.com/netblue30/firejail/commit/903fd8a0789ca3cc3c21d84cd0282481515592ef
>
> ------------------------------------------
>
> [Has vendor confirmed or acknowledged the vulnerability?]
> true
>
> ------------------------------------------
>
> [Discoverer]
> Sebastian Krahmer
Use CVE-2017-5940.
--
Regards,
Thomas Deutschmann / Gentoo Security Team
C4DD 695F A713 8F24 2AA1 5638 5849 7EE5 1D5D 74A5
Download attachment "signature.asc" of type "application/pgp-signature" (952 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
