[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <Pine.GSO.4.64.1010141401580.10412@faron.mitre.org>
Date: Thu, 14 Oct 2010 14:10:34 -0400 (EDT)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: oss-security@...ts.openwall.com
Subject: Re: CVE request: ettercap GTK
If the config file is intended to be trusted, then any issues that can
*only* be exploited through that trusted file, are not relevant for CVE
inclusion - basically, it would be the admin attacking himself/herself.
If you fix problem X, and it automatically fixes another problem Y (or, at
worst, renders it as non-security-relevant) - then you would assign a CVE
to X, and perhaps emphasize Y as one of potentially-many consequences.
Maybe other attacks are possible through that config file; but would they
be irrelevant if the config file was only accessible to the intended user?
As a distinct example: you have a web-based application that stores
content into a database, including user IDs that are validated to be
alphanumeric before insertion into the database. If an SQL injection
vulnerability is exploited, maybe the attacker could injest XSS into the
user ID. But the user ID is "trusted" in the intended security model of
the application, so the SQL injection would get the CVE, and the XSS would
be listed as a consequence.
So, in this case, it might be that CVE-2010-3844 is extraneous.
But, if it's reasonable for configuration files to be shared between users
or installations (just like pictures, packet captures, or MP3s) - then
there's a reasonable exploit scenario where the temp file issue is
irrelevant, but the format string still has an attack vector.
Hope that makes sense. This was a bane to us at CVE years ago, and was
the source of a lot of confusion and inconsistency. It happens in the web
app world all the time.
- Steve
On Wed, 13 Oct 2010, Josh Bressers wrote:
>> There are two issues here (insecure temporary file usage and
>> stack-based buffer overflow), but they're probably only
>> security-relevant when exploited in conjunction. Not sure if it
>> should get one CVE or two.
>>
>> Reference:
>> https://bugs.launchpad.net/ubuntu/+source/ettercap/+bug/656347
>>
>>
>
> We'll use two:
>
> CVE-2010-3843 ettercap GTK insecure temporary file use
> CVE-2010-3844 ettercap GTK format string flaw
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
