[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <Pine.GSO.4.51.0809232132530.10422@faron.mitre.org>
Date: Tue, 23 Sep 2008 21:51:44 -0400 (EDT)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: oss-security@...ts.openwall.com, oss-security@...ts.openwall.com
cc: coley@...re.org
Subject: Re: CVE Request (openswan, emacspeak, cman)
On Thu, 18 Sep 2008, Jan Lieskovsky wrote:
> a, openswan: Insecure auxiliary /tmp file usage (symlink attack possible)
> Affected file: /usr/libexec/ipsec/livetest
> References: https://bugzilla.redhat.com/show_bug.cgi?id=460425
> http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=496374
Use CVE-2008-4190.
There's probably also a second-order symlink vulnerability in the call to
wget using ipsec.olts.remote.log as an output file. Has that been
addressed/investigated?
Note to source auditors - pay close attention to second-order symlinks, I
bet they're hidden in a lot of places.
> b, emacspeak: Insecure auxiliary /tmp file usage (symlink attack possible)
> Affected file: /usr/share/emacs/site-lisp/emacspeak/etc/extract-table.pl
> References: https://bugzilla.redhat.com/show_bug.cgi?id=460435
> http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=496431
Use CVE-2008-4191.
> c, cman: Insecure auxiliary /tmp file usage (symlink attack possible)
> Affected file: /sbin/fence_egenera
> References: https://bugzilla.redhat.com/show_bug.cgi?id=460476
> http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=496410
Use CVE-2008-4192, to be filled in later.
- Steve
======================================================
Name: CVE-2008-4190
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4190
Reference: CONFIRM:http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=496374
Reference: CONFIRM:https://bugzilla.redhat.com/show_bug.cgi?id=460425
Reference: BID:31243
Reference: URL:http://www.securityfocus.com/bid/31243
Reference: XF:openswan-livetest-symlink(45250)
Reference: URL:http://xforce.iss.net/xforce/xfdb/45250
The IPSEC livetest tool in Openswan 2.4.4 and earlier allows local
users to overwrite arbitrary files and execute arbitrary code via a
symlink attack on the (1) ipseclive.conn and (2) ipsec.olts.remote.log
temporary files.
======================================================
Name: CVE-2008-4191
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4191
Reference: CONFIRM:http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=496431
Reference: CONFIRM:https://bugzilla.redhat.com/show_bug.cgi?id=460435
Reference: BID:31241
Reference: URL:http://www.securityfocus.com/bid/31241
Reference: SECUNIA:31880
Reference: URL:http://secunia.com/advisories/31880
Reference: XF:emacspeak-extracttable-symlink(45237)
Reference: URL:http://xforce.iss.net/xforce/xfdb/45237
extract-table.pl in Emacspeak 26 and 28 allows local users to
overwrite arbitrary files via a symlink attack on the
extract-table.csv temporary file.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
