[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20110310213243.GA3051@florz.florz.dyndns.org>
Date: Thu, 10 Mar 2011 22:32:43 +0100
From: Florian Zumbiehl <florz@...rz.de>
To: Solar Designer <solar@...nwall.com>
Cc: oss-security@...ts.openwall.com, Josh Bressers <bressers@...hat.com>,
"Steven M. Christey" <coley@...us.mitre.org>,
Stefan Fritsch <sf@...itsch.de>, Petr Uzel <petr.uzel@...e.cz>,
Thomas Biege <thomas@...e.de>, Jan Kalu??a <jkaluza@...hat.com>
Subject: Re: CVE Request -- logrotate -- nine issues
Hi,
> On Thu, Mar 10, 2011 at 07:08:38PM +0100, Florian Zumbiehl wrote:
> > What about these?:
> >
> > | However, I think that still #6 (shell injection) and #7 (logrotate
> > | DoS with strange characters in file names) should be considered
> > | vulnerabilities in logrotate: It would be reasonable to assume that you
> > | can use user input that's a valid (slash-less) filename as a (part of a)
> > | log file name (assuming that the program is running as the same user that
> > | inspects and rotates the logs, so the log directory being writable by
> > | the program would not be insecure per-se) without that file name being
> > | interpreted by a shell or causing logrotate to stop functioning,
> > | respectively.
[...]
> To summarize, it feels like in theory a privilege boundary could exist
> here and be crossed on certain systems with extra software, but in
> practice this is unlikely and it would indicate poor design of another
> piece of software or/and false sense of security put into that privilege
> boundary. I don't know what this means for CVE id assignment per the
> current "rules".
I was thinking more in the direction of an existing config that includes
a wildcard and software that uses user input to construct file names
that would be matched by that wildcard. An example of such software
would be samba, which tends to create per-client-host log files named
after those hosts. I don't have a clue whether samba could be made to
include any shell meta characters (does it even do reverse lookups for
that?), but I guess you get the idea.
Florian
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
