[<prev] [next>] [day] [month] [year] [list]
Message-ID: <1457959506.22729.0@ssh.steve.org.uk>
Date: Mon, 14 Mar 2016 12:45:06 +0000
From: Steve Kemp <steve@...ve.org.uk>
To: oss-security@...ts.openwall.com
Subject: Re: CVE-Request - GNU Awk.
> Why should these get a CVE? As you state in one of your reports:
>
> > While I appreciate that passing untrusted code to gawk is not a
> > common thing to do, I do not believe that it should be possible to
> > trigger a segfault though.
>
> Why should that be considered a valid / safe use case at all? If
> something makes awk run untrusted programs, there's code execution
> problem already:
While I suspect there is virtually no situation whereby a service
would allow the upload/processing of arbitrary awk in the wild, I
do believe that no (semi)valid program should terminate the intepreter
with a segfault.
That is the reason why I believe that that it is worthy of an
identifier. Though I will avoid making future requests for similar
issues if I'm alone in that belief!
Steve
--
http://www.steve.org.uk/
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
