[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-Id: <201403251744.s2PHi6ia004479@linus.mitre.org>
Date: Tue, 25 Mar 2014 13:44:06 -0400 (EDT)
From: cve-assign@...re.org
To: mmcallis@...hat.com
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: possible CVE request: smb4k credentials cache leak
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
> https://bugs.gentoo.org/show_bug.cgi?id=505376 notes that smb4k (an
> SMB/CIFS share browser for KDE) version 1.1.1 fixes a potential security
> issue:
>
> "Fixed potential security issue reported by Heiner Markert. Do not allow
> the cruid option to be entered via the "Additional options" line edit.
>
> http://sourceforge.net/projects/smb4k/files/Smb4K%20%28stable%20releases%29/1.1.1/
> https://bugs.gentoo.org/show_bug.cgi?id=505376#c4
> Apparently cruid is used to set the uid of the owner of the credentials cache.
Use CVE-2014-2581.
- --
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)
iQEcBAEBAgAGBQJTMb+XAAoJEKllVAevmvms7asH/iPuxfHYpHI86Z/75L+n0Qa9
fLr2TAWAdOz9WDsJuNcRNlc7jDuzXNLz8tEqYUBGD0+g1nuzqfhjCksNWEJmmNYL
tCJat/DSuijiS4MdNxEqgFIceZco4Uv8mjDkgNgM5EqbeJhq3IWRraTppFfdbiAG
agup67AsZSkf3VuV3NlwcTQfaxilsZY7TQocsFT1SU65Z//9bnGNxgm1G9sWLq4M
bWYBqyiJur7rUGY6uCMJaLw4PcDDblewZo9R1VTfn405z8iw5LZvc4g+v2arUj9l
LclDHQvIoVENBLOUgBKdNjla2GL6sEplEokFNWTgU0Tm9xDMuxU24ZeBqgwzxU8=
=ktDl
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
