[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20151030193422.GH8645@brightrain.aerifal.cx>
Date: Fri, 30 Oct 2015 15:34:22 -0400
From: Rich Felker <dalias@...c.org>
To: oss-security@...ts.openwall.com
Cc: gustavo.grieco@...il.com, cve-assign@...re.org
Subject: Re: Re: Pointer misuse unziping files with busybox
On Thu, Oct 29, 2015 at 02:04:51AM -0400, cve-assign@...re.org wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA256
>
> > http://git.busybox.net/busybox/commit/?id=1de25a6e87e0e627aa34298105a3d17c60a1f44e
>
> > Unziping a specially crafted zip file results in a computation of an invalid
> > pointer and a crash reading an invalid address.
>
> Could you please comment directly about the likelihood of
> exploitability for code execution? See the
> http://www.openwall.com/lists/oss-security/2015/10/11/5 post. We
> currently feel that a CVE assignment for a non-exploitable unzip crash
> on BusyBox may be unlikely, because BusyBox wouldn't realistically be
> used for deployment of a program that remains running to offer an
> unzipping service to multiple clients.
There are several distributions including Alpine Linux, widely used in
container environments, which by default use busybox to provide the
unzip utility. Unzipping of any files downloaded by the user, possibly
from untrusted sources, may be affected. I believe CVE is appropriate
for user-facing programs commonly used to open untrusted files even
without an automated process accepting and processing
potentially-malicious files from a client.
Rich
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
