[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20111024034027.278f5144@angelo.pretender.us>
Date: Mon, 24 Oct 2011 03:40:27 -0700
From: Reed Loden <reed@...dloden.com>
To: oss-security@...ts.openwall.com
Cc: jlieskov@...hat.com, "Steven M. Christey" <coley@...us.mitre.org>, Elio
Maldonado <emaldona@...hat.com>, Robert Relyea <rrelyea@...hat.com>, Dan
Veditz <dveditz@...illa.com>
Subject: Re: CVE Request -- nss: Did honour /pkcs11.txt and
/secmod.db files by initialization
On Mon, 24 Oct 2011 12:30:23 +0200
Jan Lieskovsky <jlieskov@...hat.com> wrote:
> a security flaw was found in the way nss, the Network Security
> Services (NSS) set of libraries, performed their initialization (the
> file path for "pkcs11.txt" configuration file was constructed
> incorrectly). When that configuration file was loaded from remote WebDAV
> or Samba CIFS share, it could lead to arbitrary security module
> load, potentially leading to execution of arbitrary code (execution of
> code from untrusted security module).
>
> Upstream bug report:
> [1] https://bugzilla.mozilla.org/show_bug.cgi?id=641052
Mozilla is a CNA. Any reason you aren't requesting the CVE from them
since NSS is a Mozilla product? Also, the upstream bug isn't tagged as a
security issue, so Mozilla might not even know about this problem.
cc'ing Dan Veditz of the Mozilla Security Group for CVE assignment and
notification.
~reed
--
Reed Loden
reed@...dloden.com
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
