[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-Id: <20150730054056.03E9DB2E116@smtpvbsrv1.mitre.org>
Date: Thu, 30 Jul 2015 01:40:56 -0400 (EDT)
From: cve-assign@...re.org
To: vkaigoro@...hat.com
Cc: cve-assign@...re.org, 775139@...s.debian.org, oss-security@...ts.openwall.com
Subject: Re: CVE request: mktexlsr/texlive: insecure use of /tmp
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
> https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=775139
> https://bugzilla.redhat.com/show_bug.cgi?id=1181167
> treefile="${TMPDIR-/tmp}/mktexlsrtrees$$.tmp"
>
> echo "$1" >>"$treefile"
This seems to be a very unusual case in which an upstream vendor
intentionally reverted the complete security patch because of
compatibility problems, and still has not (months later) added a
replacement patch:
http://tug.org/svn/texlive/trunk/Build/source/texk/kpathsea/mktexlsr?view=log
We feel that having two CVE IDs is best. This may, for example, help
with a future situation where someone decides to ship an updated
texlive package based on the latest code.
Use CVE-2015-5700 for the vulnerability originally introduced in
Revision 22885.
Use CVE-2015-5701 for the vulnerability later introduced in Revision
36855.
Also, exploitation might be relatively easy because the comment at the
beginning of the script suggests running it as root from cron at zero
minutes past each hour.
Finally, it's somewhat likely that there was a third issue:
http://tug.org/svn/texlive/trunk/Build/source/texk/kpathsea/ChangeLog?revision=37788&view=markup
2000-01-31
mktexlsr: Fix possible symlink exploit.
Unless someone wants to find a diff from 2000 and show that that
"possible" symlink exploit was a "real" symlink exploit, we are not
assigning a CVE-2000-#### ID.
- --
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQEcBAEBCAAGBQJVubhxAAoJEKllVAevmvmsnScH/jCoQFIvU3GVcsxz071iFkpI
Z18G8klqFYQDYgF0BDL0T90rh/TjvlUH1abl8SnORWN949GeDwxNYupZLyJvgvki
Fv4cysoMSmb6ZjEKDEJywjw+RAuETpqm/p+Kn2W3LxCb/3sjxMZedo8WPxFQZ9Xg
iKNjKpNkcQuqTbwZPooWhNhHaBcE8ZOXneGeH42cVpcjIaXOackSIcsu8f1tABBN
GA0rgUfRH44LE4s2JGWBpqldCoGmbaRRCrfnfDo0j2hX6Y9Pzy/cS6dtOzY2VicX
h6wL9Sficg0URNRdpRHNdo6YctN6ltp09tIqqpOJEyNAXimSOr5iNnPmWEGQGro=
=8UNr
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
