[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-Id: <201402251308.s1PD7tCB020251@linus.mitre.org>
Date: Tue, 25 Feb 2014 08:07:55 -0500 (EST)
From: cve-assign@...re.org
To: henri@...v.fi
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: CVE request: hexchat buffer overflow
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Are there realistic circumstances in which this crosses privilege
boundaries? The primary reference is mentioned at the top of
hexchat-overflow.txt but wasn't directly listed in the CVE request:
> http://www.mattandreko.com/2013/04/06/buffer-overflow-in-hexchat-294/
> It was super low severity
> I decided to try to make a working exploit out of this for fun.
> sometimes you just need to escalate privileges locally. If the HexChat
> process is running as a privileged user, you can exploit it to gain
> access to that user's permissions.
>
> This exploit was mostly just a fun experience to create. However, did
> you think of other attack vectors, such as web links using the irc://
> handler? Perhaps an attacker could fabricate a url that when the user
> clicks it, it exploits HexChat.
> of course the irc:// handler has nothing to do with the input box
> AFAIK, which you "exploited" here.
We generally haven't been making CVE assignments for cases of desktop
applications in which crafted input is entered interactively in the
UI. The existence of a well-known flaw type (e.g., buffer overflow)
and the existence of code to generate the crafted input haven't been
considered relevant in the past.
Is the nature of the attack different here?
- --
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)
iQEcBAEBAgAGBQJTDJSwAAoJEKllVAevmvmshvEIAJvW7EHnYSuHbJJ8O3WZTfKn
cuR/O+4LYq7lEHAhpDB3eD4tPPbvfTj57OfHt/LAH4Wk517N9/AVecWcnqh8i6tG
8Aq1a63bFd86tGkpqkJswcFS0VGrGXAFvvPuoVDe3CJZfcSLv+zaNW1B2kOYeGg8
0ZQTolo3itjA50zEpB8fHHRkKHRPL9D0H/WGG0wDimvNvnwYlIlYHmXBQcUrIgAg
HmHo5VSnWvRudiSSnh1NCPtGiAsBCCC9DgtFepEnd/XiogL/7fQ3FvCap14pjVGe
BMV+tUD47aEBHnwEj18Tl6NlbmdKgOLxUDULLso0XZMdoSZpL6Q+MyDVYqdghTA=
=OhXv
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
