Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sat, 16 Jul 2011 11:38:15 +0000
From: halfdog <>
CC: "Steven M. Christey" <>
Subject: Re: Apache symlink issue: can documented behavior
 be a security problem and hence get a CVE?

Hash: SHA1

Steven M. Christey wrote:
> Very rarely, we will cover "documented behavior" if there is
> sufficient evidence of widespread abuse/misuse of that behavior by
> admins, in which case the CVE description would emphasize the fact
> that it is the admin's "fault" or "misconception."  I generally try
> to stay away from edge cases (such as this one) that could have a
> "snowball effect" of setting a precedent that could ultimately be
> used to argue for assigning too many low-priority CVEs to many
> issues.  I would be inclined to avoid assigning a CVE for this issue
> unless someone can provide a realistic, relatively common scenario
> under which this would pose a significant security problem.
> Speaking of Apache, the well-known double-extension handling issue
> that enables arbitrary upload/execution of dangerous files like
> abc.php.gif also doesn't have a CVE [I don't think] for similar
> reasons, that it is well-documented behavior.

Understood. I've looked at the issue more closely and found a similar
DOS-exploitable timerace and a buffer overwrite unrelated to this. Just
for study, I'm currently trying to combine 3 timeraces + buffer
overwrite + ROP to get code execution. Since apache will quite likely
fix the other two issues, they have to touch the code anyway, so the
symlink issue might be historic soon also.

- --
PGP: 156A AE98 B91F 0114 FE88  2BD8 C459 9386 feed a bee
Version: GnuPG v1.4.6 (GNU/Linux)


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.