[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <53B5E597.5060308@redhat.com>
Date: Thu, 03 Jul 2014 17:21:59 -0600
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security@...ts.openwall.com, cve-assign@...re.org
Subject: Re: Varnish - no CVE == bug regression
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 03/07/14 02:17 PM, Stefan Bühler wrote:
> On Thu, 03 Jul 2014 13:41:58 -0600 Kurt Seifried
> <kseifried@...hat.com> wrote:
>> That also sounds like it needs a CVE then. You should not be able
>> to trivially DoS stuff, especially OOM, things should protect
>> themselves from OOM'ing especially if they accept user controlled
>> input from the network.
>
> And again "user controlled input"... a root shell also uses "user
> controlled input".
No because there is no trust boundary violation. If the root user is
logged in at a terminal executing command as root, that's fine. If a
non root user who is not authorized (e.g. via sudo or a setuid
program) is logged in and executing stuff as root, that's a trust
boundary violation.
In this case it's pretty simple: the back end web servers are NOT
supposed to be able to shut down the varnish cache server (if this was
supposed to happen you'd have built a proper channel to do so). That
they can do so means it is a denial of service, and therefore a trust
boundary violation. Ergo it needs a CVE.
> regards, Stefan
- --
Kurt Seifried -- Red Hat -- Product Security -- Cloud
PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iQIcBAEBAgAGBQJTteWXAAoJEBYNRVNeJnmTS70QAMqiFuTWJOPQOl+xJwT9nYrO
cI+E4/9X+wAfDePlEAPklYSh5m6afTT8xlx1IvpZXRWB7aYnjAc2+0n720gBPpUL
6GOtDiPrw2A5Gm8U/DC6DOm1xB13E33Ua1xQCCeHbbwJzsqhUXS7pheiu/MvYW7a
G1ve4vi1g+9IvvgjcibqfIrrAVBLknAqyPE+sJqrDtD51xo+mvFfhjXRUkscr1sr
PRw/ZA9/o76Q/mAnHVrPZt+H1ezjUaRjv/HR434vKKsB6uptp6FqXLdcYKV3DNGC
wVdGzPxFKPMV0w561ty7uiZbYorAXRJ5fHm8cURpNXSlHIJgsm5wC9h9znPWSczt
BsN6YJMQLoFVh8CsccZvhXEQ2QRb9q04zcjyhWKKl75cKcxc2wsSZuAPFf8l4Ou4
10JkCyIvsuRsqeLKaEbPKjKHvrQUvFy5YBgWDqvr3e22nwYTQsPLn4HZa1SwaJ0z
CHGxPTXfmZ8xhsRcEoZy/h/NBMF8oRhLMPnxuZZvo5vBnxtw9TaAtZ7I2WgbLRU0
EiB31mbVaiJkRsaSMLxgll/6YBP3j8Roib3oYGrcBIWHXnd5cX5mNdWC3KfeCF3k
Z1eJ/n2969Rp2kOuDWlWNuuRJ9xMyoET0shu8KkUibY1WjAE10c47dMNJFuwNKMw
di7pCcftSgS3tR2mHbRH
=qhco
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
