[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <1219769601.9043.6.camel@dhcp-lab-164.englab.brq.redhat.com>
Date: Tue, 26 Aug 2008 18:53:21 +0200
From: Jan Lieskovsky <jlieskov@...hat.com>
To: coley@...re.org
Cc: oss-security@...ts.openwall.com
Subject: Re: CVE Request (gpicview)
Hello Steve,
On Tue, 2008-08-26 at 10:19 -0400, Steven M. Christey wrote:
> Jan,
>
> Are there common usage scenarios under which gpicview would receive the
> filename to create from some external source, say, as a web browser
> plugin?
>
> I'm asking because the missing "ask_before_save" issues only seem like
> non-security bugs - the user messing him/herself up - unless the target
> file can be influenced by an external attacker.
I can't see any possibility, how the last two issues could be used by
an external attacker to destroy the targeted user image files
(when not considering the attack possible via CVE-2008-3791).
>
> > http://sourceforge.net/tracker/index.php?func=detail&aid=2019481&group_id=180858&atid=894869
> >
> > Possible symlink attack via the temporary created "/tmp/rot.jpg"
> > file used for image rotation.
>
> Use CVE-2008-3791
>
> > 2, http://sourceforge.net/tracker/index.php?func=detail&aid=2019485&group_id=180858&atid=894869
> > 3, > http://sourceforge.net/tracker/index.php?func=detail&aid=2019492&group_id=180858&atid=894869
> These two might need a second CVE depending on the influence over the file
> that "ask_before_save" would ask about.
These two rather normal bugs, than a security issues.
Thank you for checking!
Regards
Jan iankko Lieskovsky
RH Security Response Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
