[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <FC72FC641B949240B947AC6F1F83FBAF26F53771@IMCMBX01.MITRE.ORG>
Date: Fri, 14 Jun 2013 18:20:59 +0000
From: "Christey, Steven M." <coley@...re.org>
To: "felipensp@...il.com" <felipensp@...il.com>,
"oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: RE: CVE request: FD leakage for cgi program on
Monkey HTTPD
Felipe,
Sorry if this is a dumb question.
If you are using "file descriptor leak" in the sense of "malicious parties can directly access the file descriptor" - then that doesn't seem to be the case here, because permissions are limited only to you.
If you are using "file descriptor leak" in the sense of "the program does not close a file after opening it, consuming too many file descriptors," then how can a program take control of Monkey HTTPD?
- Steve
>-----Original Message-----
>From: Felipe Pena [mailto:felipensp@...il.com]
>Sent: Friday, June 14, 2013 1:24 PM
>To: oss-security@...ts.openwall.com
>Subject: [oss-security] CVE request: FD leakage for cgi program on Monkey
>HTTPD
>
>I've identified a fd leakage when running a program via Monkey HTTPD -
>CGI plugin.
>
>By runninng `ls -lah /proc/<pid>/fd/` on the CGI program we can see:
>
>total 0
>dr-x------ 2 felipe felipe 0 Jun 14 14:00 .
>dr-xr-xr-x 8 felipe felipe 0 Jun 14 14:00 ..
>lr-x------ 1 felipe felipe 64 Jun 14 14:00 0 -> pipe:[239545]
>l-wx------ 1 felipe felipe 64 Jun 14 14:00 1 -> pipe:[239546]
>lrwx------ 1 felipe felipe 64 Jun 14 14:00 10 -> anon_inode:[eventpoll]
>lr-x------ 1 felipe felipe 64 Jun 14 14:00 11 -> pipe:[242960]
>lrwx------ 1 felipe felipe 64 Jun 14 14:00 12 -> anon_inode:[eventpoll]
>lrwx------ 1 felipe felipe 64 Jun 14 14:00 13 -> anon_inode:[eventpoll]
>lrwx------ 1 felipe felipe 64 Jun 14 14:00 14 -> anon_inode:[eventpoll]
>lrwx------ 1 felipe felipe 64 Jun 14 14:00 15 -> anon_inode:[eventpoll]
>lrwx------ 1 felipe felipe 64 Jun 14 14:00 16 -> anon_inode:[eventpoll]
>lrwx------ 1 felipe felipe 64 Jun 14 14:00 17 -> anon_inode:[eventpoll]
>lrwx------ 1 felipe felipe 64 Jun 14 14:00 18 -> anon_inode:[eventpoll]
>lrwx------ 1 felipe felipe 64 Jun 14 14:00 19 -> anon_inode:[eventpoll]
>l-wx------ 1 felipe felipe 64 Jun 14 14:00 2 -> /dev/null
>lrwx------ 1 felipe felipe 64 Jun 14 14:00 3 -> socket:[240797]
>lrwx------ 1 felipe felipe 64 Jun 14 14:00 4 ->
>/home/felipe/audit/monkey/monkey/logs/monkey.pid.2001
>lr-x------ 1 felipe felipe 64 Jun 14 14:00 5 -> pipe:[240798]
>l-wx------ 1 felipe felipe 64 Jun 14 14:00 6 -> pipe:[240798]
>lr-x------ 1 felipe felipe 64 Jun 14 14:00 7 -> pipe:[240799]
>l-wx------ 1 felipe felipe 64 Jun 14 14:00 8 -> pipe:[240799]
>lrwx------ 1 felipe felipe 64 Jun 14 14:00 9 -> socket:[242784]
>
>Hence a malicious program can take control of Monkey HTTP request response
>through a network socket related file descriptor, etc.
>
>
>Report
>------
>http://bugs.monkey-project.com/ticket/187
>
>
>CREDITS
>-------
>Felipe Pena
>
>--
>Regards,
>Felipe Pena
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
