oss-security - Re: CVE request: FreeBSD/OS X crontab information leakage

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <2129000690.299846.1298927603500.JavaMail.root@zmail01.collab.prod.int.phx2.redhat.com>
Date: Mon, 28 Feb 2011 16:13:23 -0500 (EST)
From: Josh Bressers <bressers@...hat.com>
To: oss-security@...ts.openwall.com
Cc: coley <coley@...re.org>
Subject: Re: CVE request: FreeBSD/OS X crontab information
 leakage

This should probably get three.

----- Original Message -----
> Details here:
> http://marc.info/?l=full-disclosure&m=129891323028897&w=2
> 
> There are three leaks, each of which amounts to a minor DAC bypass.
> 
> 1. Leakage of file/directory existence via stat() calls (e.g.
> determining if a file exists regardless of search permissions on
> directories)

CVE-2011-1073

> 
> 2. Leakage of directory existence via realpath()

CVE-2011-1074

> 
> 3. Arbitrary MD5 comparison (e.g. ability to determine if any two
> files have identical MD5 hashes, regardless of read permissions on
> those files)

CVE-2011-1075

Thanks.

-- 
    JB

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.