oss-security - Re: CVE request: oping allows the disclosure of arbitrary file contents

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Pine.GSO.4.51.0911091900020.4011@faron.mitre.org>
Date: Mon, 9 Nov 2009 19:01:40 -0500 (EST)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: oss-security@...ts.openwall.com
cc: "Steven M. Christey" <coley@...us.mitre.org>
Subject: Re: CVE request: oping allows the disclosure of 
 arbitrary file contents

On Sat, 17 Oct 2009, yersinia wrote:

> On Fri, Oct 16, 2009 at 10:06 PM, Josh Bressers <bressers@...hat.com> wrote:
> > ----- "Julien Tinnes" <julien.tinnes@...il.com> wrote:
> >
> > [snip]
> >
> > I took a look in the oping source. Without another security flaw, this is just
> > a bug, oping doesn't do anything while still root that could be an issue. I
> > agree that it should be fixed, it is a serious bug, but an attacker cannot do
> > anything nefarious with this flaw.
> I think that the upstream mantainer should be have the last word
> http://verplant.org/liboping/

This says:

  2009-09-29 Version 1.3.3 is available. The new release fixes a serious
  security issue in oping: If the application is installed with the
  SetUID-bit, anybody on the system could use oping to read arbitrary
  files using the "-f" option.

So as stated, this sounds worthy of a CVE to me.  Thoughts?

- Steve

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.