[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20141103215227.GA6000@zoho.com>
Date: Mon, 3 Nov 2014 21:52:27 +0000
From: mancha <mancha1@...o.com>
To: oss-security@...ts.openwall.com
Cc: cve-assign@...re.org
Subject: Re: Re: strings / libbfd crasher
On Mon, Nov 03, 2014 at 01:43:54AM +0300, Alexander Cherepanov wrote:
> On 2014-10-31 08:57, cve-assign@...re.org wrote:
>
> Thanks for assigning CVEs for these issues but I have a couple of
> questions regarding CVE-worthiness of various things. And some
> questions for the community.
>
> >Use CVE-2014-8502 for the objdump-pe-crasher2 issue.
>
> Here, AddressSanitizer said "heap-buffer-overflow" and then "READ of
> size 1".
>
> Why this crasher is judged as CVE worthy? Is it oversight or are
> invalid reads assumed to be exploitable by default?
>
> Another possibility is to treat all crashes in all libraries as CVE
> worthy. We don't know how these libraries are used ITW and any crash
> in any of them could potentially lead to data loss in some
> application. But...
>
> ...it seems libbfd is not treated as a library any crash in which is
> CVE worthy.
>
> >Use CVE-2014-8503 for this ihex parser issue.
>
> Again "READ of size 1".
Thanks for your post. I would also find it instructive if MITRE shed
light on its CVE assignation heuristics for libbsd. Response to libbfd
issues can be particularly enlightening because the issues vary largely
in scope & type.
In the past, I've noticed a liberal approach to CVE allocation when
dealing with libraries due to what you said: it is often difficult to
assess the security impact of flaws because they ultimately depend on
the context of applications using the library. As case in point, the
NULL pointer dereference crasher (zero-size S-record) DoS'es manchabfd
0.42a1 (small network daemon I just wrote). That flaw didn't receive a
CVE.
--mancha
unedited post: http://www.openwall.com/lists/oss-security/2014/11/02/4
Content of type "application/pgp-signature" skipped
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
