[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <Pine.GSO.4.51.0811202048180.20524@faron.mitre.org>
Date: Thu, 20 Nov 2008 20:52:42 -0500 (EST)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: oss-security@...ts.openwall.com
cc: coley@...re.org, Jamie Strandboge <jamie@...onical.com>
Subject: Re: CVE Request - ecryptfs-utils
CVE practice in this case is to place fault on the program that's sending
the passwords over the command line. Arguably it could go the other way,
but CVE generally doesn't cover what I call "design limitations" - issues
that are not fundamental security vulnerabilities in themselves, but which
make it easier for others to introduce them. THe ecryptfs-setup-private
feature of accepting command-line password arguments isn't fundamentally
different than strcpy()'s feature of happily writing past the end of the
buffer if that's what it's told to do. This line continues to get fuzzy,
however.
- Steve
======================================================
Name: CVE-2008-5188
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5188
Reference: MLIST:[oss-security] 20081023 CVE request for ecryptfs
Reference: URL:http://www.openwall.com/lists/oss-security/2008/10/23/3
Reference: MLIST:[oss-security] 20081029 Re: CVE request for ecryptfs
Reference: URL:http://www.openwall.com/lists/oss-security/2008/10/29/4
Reference: MLIST:[oss-security] 20081029 Re: CVE request for ecryptfs
Reference: URL:http://www.openwall.com/lists/oss-security/2008/10/29/7
Reference: CONFIRM:http://git.kernel.org/?p=linux/kernel/git/mhalcrow/ecryptfs-utils.git;a=commit;h=06de99afd53f03fe07eda0ad9d61ac6d5d4d9f53
Reference: CONFIRM:https://launchpad.net/bugs/287908
The (1) ecryptfs-setup-private, (2) ecryptfs-setup-confidential, and
(3) ecryptfs-setup-pam-wrapped.sh scripts in ecryptfs-utils 45 through
61 in eCryptfs place cleartext passwords on command lines, which
allows local users to obtain sensitive information by listing the
process.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
